Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-1610 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical | 5.3 | 13% | PoC | |
| CVE-2025-2611 | The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that… | 9.3 | 6% | ||
| CVE-2025-6389 | Unauthenticated Remote Code Execution in Sneeit Framework WordPress Plugin | 9.8 | 76% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | racoonlab.top | lso downloads an ".htaccess" file from an external server ("racoonlab[.]top") onto the compromised host. "This .htaccess file ensures |
| ipv4 | 114.10.116.226 | 226[.]51 89.187.175[.]80 194.104.147[.]192 196.251.100[.]39 114.10.116[.]226 116.234.108[.]143 The WordPress security company said it |
| ipv4 | 116.234.108.143 | 75[.]80 194.104.147[.]192 196.251.100[.]39 114.10.116[.]226 116.234.108[.]143 The WordPress security company said it also observed mali |
| ipv4 | 182.8.226.51 | riginated from the following IP addresses - 185.125.50[.]59 182.8.226[.]51 89.187.175[.]80 194.104.147[.]192 196.251.100[.]39 114.10 |
| ipv4 | 185.125.50.59 | e attacks have originated from the following IP addresses - 185.125.50[.]59 182.8.226[.]51 89.187.175[.]80 194.104.147[.]192 196.251. |
| ipv4 | 194.104.147.192 | addresses - 185.125.50[.]59 182.8.226[.]51 89.187.175[.]80 194.104.147[.]192 196.251.100[.]39 114.10.116[.]226 116.234.108[.]143 The W |
| ipv4 | 196.251.100.39 | 25.50[.]59 182.8.226[.]51 89.187.175[.]80 194.104.147[.]192 196.251.100[.]39 114.10.116[.]226 116.234.108[.]143 The WordPress security |
| ipv4 | 89.187.175.80 | the following IP addresses - 185.125.50[.]59 182.8.226[.]51 89.187.175[.]80 194.104.147[.]192 196.251.100[.]39 114.10.116[.]226 116.2 |
From the original article
3 min read at thehackernews.com
A critical security flaw in the Sneeit Framework plugin for WordPress is being actively exploited in the wild, per data from Wordfence. The remote code execution vulnerability in question is CVE-2025-6389 (CVSS score: 9. 8), which affects all versions of the plugin prior to and including 8.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.