In March 2019, Wordfence described exploitation of a vulnerability in Abandoned Cart Lite for WooCommerce. Malicious data stored by the plugin could run code in the browser when an administrator reviewed abandoned carts. The observed attacks sought administrator access and installed ways to retain access.
WordPress and its plugins need separate maintenance
This case showed why an updated WordPress installation can still contain a vulnerable plugin. Maintenance needs to cover WordPress core, the plugins and the themes actually installed. Follow their publishers’ advisories and use maintained versions compatible with your website.
Fixing a vulnerability closes an attack route, but does not prove that an already compromised website has been cleaned. An added account or modified file may require separate investigation.
Responding to suspicious behaviour
If you find an unfamiliar administrator, an unexpected change or a security alert, record the symptoms and when they appeared. Contact your provider through a known channel to arrange a review of access, files and available records. Avoid randomly deleting items that could help explain the incident.
Recovery needs to address the cause and verify access, not simply put an older backup online. Read Wordfence’s original analysis for the historical context and the official WordPress guidance on compromised websites to help prepare a response.
Keep the response connected to your business
For an online store, a response also needs to account for orders, customer access and the people who manage the website. Nuagerie can help hosted customers distinguish a hosting question from application work and identify the checks or specialist assistance needed for the reported problem.
Contact us through the client area with the affected site, the plugin involved and the first observed symptom. Say whether the store is still accepting orders and which recent changes are known. This helps frame the next steps around the evidence available and the business activity that needs attention.
