If you have a WordPress page, you should check the status of your installtion right away. Because there was a massive attempt of a hacker group to capture more than 900.000 pages.
Hackers tried to insert malicious JavaScript Code into WordPress pages that diverts visitors to manipulated webpages. They also scanned for admin logins to install backdoor accounts.
The hackers exploited vulnerabilities which are known for months or years and have been patched in the past. However, if you haven’t updated your WordPress page in a while, chances are that your plugins can have unpatched vulnerabilities. If you have plugins from the list below, you should check them:
An XSS vulnerability in the Easy2Map plugin, which was removed from the WordPress plugin repository in August of 2019, and which we estimate is likely installed on less than 3,000 sites. This accounted for more than half of all of the attacks.
An XSS vulnerability in Blog Designer which was patched in 2019. We estimate that no more than 1,000 vulnerable installations remain, though this vulnerability was the target of previous campaigns.
An options update vulnerability in WP GDPR Compliance patched in late 2018 which would allow attackers to change the site’s home URL in addition to other options. Although this plugin has more than 100,000 installations, we estimate that no more than 5,000 vulnerable installations remain.
An options update vulnerability in Total Donations which would allow attackers to change the site’s home URL. This plugin was removed permanently from the Envato Marketplace in early 2019, and we estimate that less than 1,000 total installations remain.
An XSS vulnerability in the Newspaper theme which was patched in 2016. This vulnerability has also been targeted in the past.
There are indications that hackers will use other vulnerabilities in the future. The best you can do is to stay up to date.
Source: Nearly a Million WP Sites Targeted in Large-Scale Attacks
