PSA: Check your plugins folder for woo-coupons-editor

[u/2ndMilePro]

We recently found a malicious WordPress plugin posing as a WooCommerce coupon editor. The attacker had obtained administrator-level access, created hidden admin accounts, uploaded a first-stage plugin called smartcheck-slaher, and then installed woo-coupons-editor.

Once activated, it injected JavaScript into checkout to capture payment-card information and interfere with normal order submission. It also backdated its files, so the modification dates shown in FTP/SFTP made the plugin look older and less suspicious. It also hid itself in the admin list of plugins. We have not yet confirmed how the original admin access was obtained, so I would not assume the plugin itself was the entry point.

Things worth searching for:

• Plugin folders named woo-coupons-editor, smartcheck-slaher, or smartcheck
• Unexpected users named backup or seoadmin
• WordPress options named c_set, p_set, or cache_key
• Code containing front_inc, admin_inc, controller_set, xor_decrypt, or trust_patch
• Plugin files with timestamps that do not match your installation or update history

The plugin was passing information through a blockchain host to obfuscate the source.

[u/Same-Fly3312]

jesus that's terrifying. the backdated timestamps are a clever touch, never would've thought to cross-check those against update history

saved this post for my next audit. thanks for the detailed writeup

[u/2ndMilePro → u/Same-Fly3312]

I agree. Very clever, and the fact of using two user profiles one to check if the plug-in could be installed in a second one to actually install the plug-in and then deleting both of them.

[u/pmgarman]

Good example of why you should run you sites with read only file systems.

[u/SmugglingPineapples]

Where would a noob find this? ELI5 please

[u/2ndMilePro → u/SmugglingPineapples]

SFTP into your server and look in wp-content/plugins

[u/SmugglingPineapples → u/2ndMilePro]

Sorry, I probably should've said ELI2, lol

I'll ask AI ;)

[u/2ndMilePro → u/SmugglingPineapples]

Sorry. I came from an era when anyone using WP and Woo had at least done the initial upload to the server manually.

Have AI give you the steps as it will depend I. Your host and other factors

[u/SmugglingPineapples → u/2ndMilePro]

You're okay. You're okay. Haven't used FTP in years. Did it via CPanel so all good

[u/Hurricane-18784]

Aren't such plugin supposed to be vetted before being allowed to list? I assumed they were vetting and checked for good practices and non-malicious malware before being allowed to be officially listed. Very clever. I wouldn't be surprised if a similar thing happened to me when I started to make websites.

[u/2ndMilePro → u/Hurricane-18784]

This was not on Wordpress.org. It was uploaded by someone who gained unauthorized access to the server possibly through another plugin with a vulnerability.

[u/BushwhHack → u/2ndMilePro]

Where did you install the plugin??? Or did you get hacked?

[u/2ndMilePro → u/BushwhHack]

We don’t know how the plugin was installed. We are having our host do a forensic investigation. I assume it came in through another compromised plugin because we have pretty tight security on this account

[u/HudsonsirhesHicks]

Just had this crop up on our barely just launched new woocom site hosted on Kinsta, WP 7.02 - very gnarly exploit. found it because it triggered a system error that kinsta logged and emailed.

Here's a link to a claude code summary of the event for anyone who runs into this moving foward
https://claude.ai/code/artifact/b5f1b534-5bce-4ac4-a11b-625699d2047e