A WordPress and WooCommerce shop selling professional services called us because customers could not pay: the card payment form on the checkout page had stopped loading.
The site had been hacked six days earlier, and the plugin breaking the checkout was a fake copy of a well-known security plugin.
The symptom was not the problem
A broken checkout usually means a payment plugin update or a settings change. We started there, and the browser console gave us the first real clue. The page was sending a security header, a Content Security Policy, that told the browser not to load anything from the payment provider. So the payment form was being blocked before it could appear.
Nobody had set that header. It was coming from a plugin called Wordfence, which is a real and widely used WordPress security plugin. Except this one was not Wordfence. It sat in a folder with a number tacked on the end of its name, and it had been installed the best part of a week before.
What the attacker had left behind
Once we knew what we were looking for, the full picture came together quickly. Everything the attacker planted carried the same number on the end of its name, which made it easier to track down:
- Three fake plugins, dressed up as a security plugin, a cron manager and a user tool
- Three "must-use" plugins, a type of WordPress plugin that runs on every page load and does not appear in the normal plugins list or need switching on
- A folder of gambling and casino spam articles in German and Spanish, and five spam posts added to the database with backdated publish dates so they would not stand out
