New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installing Malicious Plugins

TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication. Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor. Many administrators stay signed in to wp-admin in the same profile they use for everyday browsing. That... Weiterlesen: New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installin…