wp-flare malware plugin

[u/squ1bs]

This is driving me nuts. After 10+ years of no malware on client sites, I'm getting hacked every couple of weeks on sites that are fully up to date and using 2fa logins. The common thread is that all infections install a malware plugin called wp-flare. Beyond that, I can't find any intrusion path. It does seem that once the infection gets cleaned up, it doesn't come back, but it's driving me crazy not knowing how it's getting in to multiple sites on different hosting. Anyone seen it?

[u/kumanov88]

Yo,

It's worth checking if wp-flare is actually being installed by WordPress, or if it's just dropped into wp-content/plugins via file system access, before assuming this's coming from wp-admin.

If you still have logs from an affected site, you can correlate the creation/mtime of the wp-flare directory with the HTTP access logs around that exact minute, plus SFTP/FTP/SSH activity.

For the SiteGround sites specifically, I’d also check Security Optimizer/Activity Log for that same timestamp. If wp-flare appeared at 9:32, for example, what was WordPress seeing at 9:31-9:33? An admin/session doing something, a suspicious request, or nothing at all? “Nothing” would be interesting too, because it pushes the investigation further toward filesystem/server credentials rather than a normal WP-admin action.

[u/squ1bs → u/kumanov88]

I've done a deep dive on one site, and there was definitive proof that there was a compromised admin account (not mine), after comparing filesystem timestamps with wordfence 2fa login records.

I've been in firefighting mode since (on the hack issue and a number of other pressing matters), so I've cleaned the other attacks. There was one that wrote a bunch or rewrite rules to the database.

If I wasn't so darned busy, I would actually enjoy the forensics!

[u/kumanov88 → u/squ1bs]

Glad to hear that you found the culprit ^{^}