TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication. Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor. Many administrators stay signed in to wp-admin in the same profile they use for everyday browsing. That habit gives attackers a usable foothold. […]
This article has been indexed from GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Read the original article:
New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installing Malicious Plugins