Trusted Design

Backdoor in Wordpress plugin

概要

Custom Content Type Manager (CCTM) is a relatively popular plugin with three years of development, 10,000+ active installs, and a satisfaction rating of 4.8. It helps create custom post types. Website owners find the classical “blog format” too restrictive, use the plugin to add custom elements to their posts. So far so good. It looked like a typical backdoor that could be uploaded anywhere on a compromised server, not just in this particular plugin. We decided to check the original plugin package and, to our surprise, found the file in the source! We also discovered that we were not the only ones that found this file (although people on the forum seemed to believe that the file was just “vulnerable”). This really was worth investigating.

Created: 2026-02-23

Indicators

• domain - trimtoroot.com -
• domain - wordpresscore.com -
• domain - donutjs.com -

類似Pulses

• Chinese threat actor - Wordpress exploits and PHP file dropper (score: 0.58)
• Evolution of Pseudo Darkleech (score: 0.56)
• WordPress Compromise Campaign (score: 0.56)
• Exploring CVE-2015-2545 and its users (score: 0.55)
• Suspicious IP addresses (score: 0.55)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る