Security firm Avast is advising webmasters to scan sites and update log-in credentials following the discovery of a malware attack targeting the WordPress publishing platform.
The attack exploits a vulnerability in an image plug-in for WordPress, allowing an attacker to access a site and use the platform to distribute malware payloads and harvest FTP log-in credentials for users and administrators.
Jan Sirmer, senior virus lab researcher at Avast, said that a flaw in the TimThumb image plug-in allows the attackers to infect sites running WordPress with a malicious PHP file.
The attack is believed to be conducted through a commercially available toolkit called BlackHole, and redirect users to sites that attempt to install malware.
Sirmer warned that in some cases the attack had gone unnoticed by administrators because the sites were hosted by third-party service providers.
Avast urged administrators to scan their own systems, and to visit their sites with PCs running anti-virus software to detect possible infections on hosted pages.
"WordPress is not immune to exploitation, a fact driven by its overall popularity and the wide number of available versions," Sirmer said.
"Stronger log-in and password keys, alone or together with two-factor authentication, are options that system administrators should use when working with third-party IT managers."
Microsoft claims Check Point's methodology is all wrong - figure more like five million, not 250 million
Microsoft's explanation still raises as many questions as it answers
Wikileaks dumps info on 'Brutal Kangeroo', the CIA's malware toolkit for hacking 'air-gapped' networks
CIA's Brutal Kangeroo malware suite likened to Stuxnet
Commuters less than chuffed - many fined for not having a ticket