Once installed, the malicious code performs several actions to ensure persistence and control over the compromised WordPress environment. It drops persistent PHP files within the 'mu-plugins' and 'uploads' directories, creates a passwordless administrator account, and registers scheduled tasks that persist even if the primary plugin is removed. Defenders must audit their WordPress installations for the presence of this specific file and check for unauthorized administrator accounts or unrecognized files in the 'mu-plugins' directory.

Attack Chain

1. Attacker gains control of or spoofs a decommissioned update server associated with the Ninja Tables plugin.
2. The compromised server pushes a tampered version of the Ninja Tables Pro 5.2.11 plugin to clients.
3. The plugin installation executes the payload, dropping the malicious file app/Library/updater/NinjaTableDataSync.php.
4. The malicious PHP code activates a backdoor REST API endpoint to receive external commands.
5. The backdoor drops additional persistent PHP payloads into the WordPress 'mu-plugins' and 'uploads' folders.
6. The script creates a new, passwordless administrator account to ensure future access.
7. The script registers scheduled tasks (cron jobs) to maintain persistence across plugin updates or removals.
8. The attacker uses the established backdoor and administrator account to facilitate ongoing unauthorized access and system manipulation.

Impact

The vulnerability allows for full, unauthenticated administrative control over the affected WordPress environment. This enables the attacker to exfiltrate data, modify site content, or use the compromised site as a platform for further attacks. Given the nature of the persistence mechanisms, cleanup requires manual removal of malicious files and database entries beyond simply updating or deleting the affected plugin.

Recommendation

• Perform a file integrity audit on all WordPress installations using Ninja Tables Pro to identify the existence of app/Library/updater/NinjaTableDataSync.php.
• Audit the 'mu-plugins' directory for any unauthorized PHP files that were not manually installed by your organization.
• Review all WordPress user accounts for suspicious, passwordless, or unexpected administrator-level accounts.
• Remove any scheduled tasks (WP-Cron) associated with the Ninja Tables plugin and verify no other rogue tasks remain.
• Use the Sigma rule provided below to monitor for the creation or execution of files within the 'mu-plugins' path, as this is a common persistence location for web-based attacks.