WordPress Admins Warned About Malicious Plugin Stealing Credentials
A new threat has emerged in the WordPress ecosystem with the discovery of a malicious plugin named “wp-runtime-cache.” This plugin poses a serious risk to WordPress site administrators by employing a sophisticated attack method designed to steal admin login credentials.
WordPress powers a significant portion of the internet, making it a prime target for cybercriminals. The “wp-runtime-cache” plugin masquerades as a legitimate caching tool, enticing administrators to install it in the hope of improving site performance. However, once activated, it covertly captures sensitive information such as usernames and passwords, potentially exposing the entire site to unauthorised access.
This advanced form of malware highlights the growing need for vigilance among WordPress users. Site owners should only download plugins from official repositories or well-known, trusted sources, and regularly audit their installed plugins for unfamiliar or suspicious entries. Additionally, enabling two-factor authentication and keeping WordPress core and plugins updated can significantly reduce security risks.
Security experts urge administrators to immediately check for signs of the “wp-runtime-cache” plugin on their sites and remove it if found. Early detection is critical to preventing data breaches and safeguarding valuable website content.
As threats like “wp-runtime-cache” continue to evolve, staying informed and practising good cybersecurity hygiene remains essential for maintaining a secure and trustworthy online presence.
Source: WordPress Admins Cautioned About Fake Cache Plugin Stealing Admin Credentials
Author: Aman Mishra
