Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

TRUST#GRAFT uses logged-in WordPress admins to install a hidden plugin

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Securonix describes TRUST#GRAFT, a browser-side chain that installs a hidden WordPress plugin through an already signed-in admin session.

Securonix describes TRUST#GRAFT, a browser-side attack that does not bypass WordPress authentication. A JavaScript loader waits for a signed-in administrator visiting a compromised page, reads the plugin-upload nonce, and posts a staged ZIP named wm.zip through the normal plugin endpoint. The installed plugin, Web Media Optimizer 2.1, injects remote JavaScript, disables TLS certificate checks, and can set an admin cookie with a hardcoded token. On activation it copies itself to wp-content/mu-plugins/wmedia-recovery.php, which WordPress loads automatically and which remains after the visible plugin is deleted. Securonix has not confirmed the initial delivery vector; hosting of observed loaders is not attribution.

Key facts
  • The chain needs an already signed-in WordPress administrator and does not bypass authentication.
  • It uploads wm.zip and activates Web Media Optimizer version 2.1 through the normal plugin endpoint.
  • Activation copies the payload to wp-content/mu-plugins/wmedia-recovery.php, which WordPress loads automatically.
  • A hardcoded token can set an auth cookie for the first administrator or change the remote script.
  • Securonix lists loader candidates on gerlace.com, vtevens.icu, and caapman.me.
  • The loader can read page-accessible tokens but not HttpOnly cookies.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersDetails fake Cloudflare screen, clipboard theft, cookie limits, and non-attribution of hosting.
  • Cyber Security NewsSays the loader waits for an admin to visit a compromised page.
Products
WordPressWeb Media Optimizer
Malware
TRUST#GRAFTwmedia-recovery.php
Organizations
Securonix

Coverage

oldest first · one row per article · UTC
  1. · 4d ago GBHackersFirst report

    TRUST#GRAFT uses logged-in WordPress admins to install a PHP backdoor

    The chain uploads wm.zip as Web Media Optimizer and copies itself to mu-plugins so deleting the visible plugin leaves it loaded.

  2. · 3d ago Cyber Security News

    Logged-in WordPress admins tricked into installing hidden PHP backdoors

    Securonix calls the chain TRUST#GRAFT; a fake Cloudflare screen uploads wm.zip and hides it as a must-use plugin.