Supply Chain Compromise of Fluent Forms Pro via Tampered Update Server

Fluent Forms Pro version 6.2.7 was subjected to a supply chain attack where a decommissioned update server was leveraged to deliver a compromised plugin build. This tampered build included an embedded malicious PHP file, 'libs/class-license-sync.php', which was dynamically invoked via an added 'require_once' statement in the core 'fluentformpro.php' file. Once active, this backdoor established unauthorized REST API endpoints and implemented multiple persistence mechanisms. The compromise allows attackers to maintain access even if the parent plugin is removed. This incident highlights the critical risk of relying on legacy update infrastructure and the importance of verifying plugin integrity from authorized sources. Defenders should immediately audit WordPress environments for the presence of the malicious file and unauthorized administrator accounts.

Attack Chain

1. Attacker redirects traffic from a decommissioned update server to serve a tampered plugin archive.
2. Administrator or automated system updates Fluent Forms Pro to the malicious version 6.2.7.
3. The modified 'fluentformpro.php' triggers 'require_once' to load the malicious 'libs/class-license-sync.php'.
4. The backdoor script registers an unauthorized REST API endpoint for remote command execution.
5. The script drops persistent files within the 'mu-plugins' directory to ensure continued execution across requests.
6. The backdoor creates a passwordless administrative account to secure ongoing unauthorized access.
7. Scheduled tasks (WP-Cron) are registered to maintain command and control callbacks.
8. Final objective achieved: long-term persistence and full administrative control of the WordPress instance.

Impact

The compromise of Fluent Forms Pro 6.2.7 enables complete site takeover, unauthorized exfiltration of form-submitted data, and potential lateral movement from the affected web server. Given the high privileges associated with the injected administrator account and the persistence in 'mu-plugins', attackers can maintain access indefinitely regardless of plugin status. All organizations using this version should consider their form data and administrative credentials compromised.

Recommendation

• Identify and remove the file 'libs/class-license-sync.php' from all WordPress installations.
• Audit the 'wp-content/mu-plugins' directory for any unauthorized or unknown PHP files.
• Review the WordPress user database for unauthorized accounts, specifically those without passwords or with anomalous creation dates.
• Remove any unauthorized WP-Cron tasks associated with the identified backdoor or plugin directories.
• Immediately upgrade to a verified, clean version of the plugin obtained directly from the official vendor repository.
• Restrict outbound network access from web servers to block unauthorized C2 communication paths identified in server access logs.