Return-Path: <1axcegl1shipggj3q3141w7akxwqdcfq7t2df2-help=rommedia.eu@4354010m.wordfence.com>
Delivered-To: help@rommedia.eu
Received: from web05.ouiheberg.com
	by web05.ouiheberg.com with LMTP
	id CALuIPXsp2U9Zw0Aw70cEg
	(envelope-from <1axcegl1shipggj3q3141w7akxwqdcfq7t2df2-help=rommedia.eu@4354010m.wordfence.com>)
	for <help@rommedia.eu>; Wed, 17 Jan 2024 16:06:29 +0100
Return-path: <1axcegl1shipggj3q3141w7akxwqdcfq7t2df2-help=rommedia.eu@4354010m.wordfence.com>
Envelope-to: help@rommedia.eu
Delivery-date: Wed, 17 Jan 2024 16:06:29 +0100
Received: from bid458m.4354010m.wordfence.com ([158.247.16.68]:41393)
	by web05.ouiheberg.com with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.96.2)
	(envelope-from <1axcegl1shipggj3q3141w7akxwqdcfq7t2df2-help=rommedia.eu@4354010m.wordfence.com>)
	id 1rQ7Ug-003gOX-1H
	for help@rommedia.eu;
	Wed, 17 Jan 2024 16:06:29 +0100
Received: by 172.16.227.89 with SMTP id azkdahsnrah60sw3i663vvcy6l3ddxgdeqia3qeu9;
        Wed, 17 Jan 2024 15:05:46 GMT
DKIM-Signature: v=1; s=hs1; d=4354010m.wordfence.com; 
        i=@4354010m.wordfence.com; 
        h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id:list-unsubscribe-post; 
        a=rsa-sha256; c=relaxed/relaxed; 
        bh=nNYXmvkZN+Zf/4h2+GXpsPFASBgS2QqgDOcT9Sz2EX4=; 
        b=fK9QZi3/iCXP3voEtLJyQgqJySJ3ALEXJxo6r1AALsc4xIoz+3HWLIUaNGpryk
         vsSSHUMxDagpyzOzuTSEzEKyt7Il35eOFa2Jtx3XnCt6X3kyEXgBsV7UmGcA7ef
         MS/Vb+Of6xREFw7NhpVyRjU25eR2zp52F0bPz0yo1UfbhE5CNoE/QZfBgCpTw/P
         bUT5wd3xRg7xDDfW8nqQaYdAywkOMyoxFaGBZMlyuG9T5EBEH2fjOXgjdEGxiOo
         8/Md1fsO5Y3dWjZv2M309Fof3oJ5/geqZ/jjr4fWyU25mv6kslZRwsTfUTbSCtz
         b0UUPP/aIQebaP1fgxrq8qjmrN8w==; q=dns/txt; t=1705503945; 
        x=1705766745;
DKIM-Signature: v=1; s=hs1; d=wordfence.com; i=@wordfence.com; 
        h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id:list-unsubscribe-post; 
        a=rsa-sha256; c=relaxed/relaxed; 
        bh=nNYXmvkZN+Zf/4h2+GXpsPFASBgS2QqgDOcT9Sz2EX4=; 
        b=Q+wMLLK7JF5HmUEtiMFl4kCStGQiCublp9T/Yknna/6SHSTcrTxazTuPL80kSf
         FuXVvqxwhtPOcfVdcoE3dyL1XkL1RzN9vMup302zA5M0AnYmPUKTfkb6YFMRczI
         FTKHXFl1RzvOjp4lpWXEYo03HfZOMo47oRxLi1Zvni3MaqcaLMvQo28xxYwyZNa
         +kTunw12DBSLATSSg1SJR4nGqipt187jWAh1S30d1w6N0ZT2+k4SAvdTlF9CB2C
         8rAhDA+9OGOBiNudmr+1+KtNd5XhoxIkUL4ZT05Ay4j1JIaOmt11HX0ODwgLB/P
         rRNI8cWdFLrvvySkriahDLruxlrw==; q=dns/txt; t=1705503945; 
        x=1705766745;
X-HS-Cid: 1axfmrdl0jh2bt9ruym93i6paekkpog3zi3q0y
List-Unsubscribe: <mailto:1axdo3rgiv8oiu7851pdr58josn1xqm1u1n4nm-help=rommedia.eu@4354010m.wordfence.com?subject=unsubscribe>
Date: Wed, 17 Jan 2024 07:05:46 -0800
From: Wordfence <list@wordfence.com>
Reply-To: no-reply@wordfence.com
To: help@rommedia.eu
Message-ID: <1705503301753.4241de4b-6b40-4622-bfd6-a5f7cf6b839b@4354010m.wordfence.com>
Subject: [WordPress Security] Website Takeover Campaign Takes Advantage of
 Unauthenticated Stored Cross-Site Scripting Vulnerability in Popup Builder
 Plugin
MIME-Version: 1.0
Content-Type: multipart/alternative; 
	boundary="----=_Part_3216850_1529249456.1705503945122"
X-Report-Abuse-To: abuse@hubspot.com (see
 https://policy.hubspot.com/abuse-complaints)
X-Spam-Status: No, score=-2.0
X-Spam-Score: -19
X-Spam-Bar: --
X-Ham-Report: Spam detection software, running on the system "web05.ouiheberg.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Attackers are leveraging XSS to inject administrative user
    accounts and takeover sites. Wordfence-Logo.png (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP3prCCW6N1vHY6lZ3mXVc0GsP94sRYqW3JcDMd5b4bZzW57rmnQ4w8zssW5Zs0Hp7Z4C96W7MMF569l1C95Vs
    [...] 
 Content analysis details:   (-2.0 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: wordpress.org]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [158.247.16.68 listed in zen.spamhaus.org]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: wordfence.com]
  0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: wordpress.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                             identical to background
  0.0 HTML_MESSAGE           BODY: HTML included in message
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.0 T_SCC_BODY_TEXT_LINE   No description available.
 -1.8 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
X-Spam-Flag: NO

------=_Part_3216850_1529249456.1705503945122
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Attackers are leveraging XSS to inject administrative user accounts and tak=
eover sites.

Wordfence-Logo.png (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJ=
bg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP3prCCW6N1vHY6lZ3mXVc0GsP94sRYqW3Jc=
DMd5b4bZzW57rmnQ4w8zssW5Zs0Hp7Z4C96W7MMF569l1C95VsNbzC1RtjbWN1VYBhxGqjCWN2y=
GH0W-MtQBW5hhSD-8sRbCMW8WT5-X2618CnW7TnZz26XzLZHW7w9fbS79xQXXW3RQFS64lMllGW=
21DmVm7J-hPrW8qj-jT8fdqplW8R4P2t83xtNsN6F6sjmJHPn9W7_f8J18NtWW4W2DhGTl4XX2Q=
0W5qtPSR4K55r3W8xTG6f5-Bx3MN8BsPbJKJS4Nf4y2PDF04 )

FeaturedImage_Wordfence_72.05 (https://email.wordfence.com/e3t/Ctc/GC+113/c=
wG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45m_5PW7lCGcx6lZ3nVW2WyR=
K94Hy15FW8ygxCk3WyS_xW1HFwGP6t8dJRW5Jk8r04RS12KV7Pw8L18CbnPW6gBsQ-4mD60jVNP=
KjB8nNmSkW8SD5Cm3lHR5yVGKS1r3js0zpW8m4rbX3vy9fCW6LNqWN7-X7JkW2nKsLG47NbWQW4=
Phy292rFNkBW2bnTln8HghpbMjhqWFbbP-1W8x35ld1t92V4W2h-QbF58FQ5sW4TmyG06Nx8B6W=
5lgr_X4Sbpc1W7SRJ_S6dVcR6W7lzDGq7Lxd5LW4vwmY73wmP3lV7QYJZ829Rp7N3Bj3pFdmhr5=
W8lhT7Y1TCVmrW4w46Wm3NLF-rW8ngsCf4M9dVGW1VF9wD57QcHMW2_n1C93xxf5vW3mvVDn8SB=
yT4W2hV2dz2T03GjW5hLBWC2Ks8Z6N5kWlDgHYt31W6HzwrS6VXK-rW25Fck98GfM2FW6whpTJ5=
QZWTNN5PjbrQGVN82W8k3GZ788tdt8W1J-LNR1QQ3QqW1-59RT8NKb5Hf72RkMd04 )

On December 11, 2023, we added an Unauthenticated Stored XSS vulnerability =
in the Popup Builder WordPress plugin to our Wordfence Intelligence Vulnera=
bility Database. This vulnerability, which was originally reported by WPSca=
n, allows an unauthenticated attacker to inject arbitrary JavaScript that w=
ill be executed whenever a user accesses an injected page.

Later on January 10th, 2024 we received an interesting malware submission d=
emonstrating how a Cross-Site Scripting (XSS) vulnerability in single plugi=
n can allow an unauthenticated attacker to inject an arbitrary administrati=
ve account that can be used to take over a website. This type of vulnerabil=
ity is often exploited in order to add spam content or malicious redirects =
to a compromised website, which we frequently see when performing Care and =
Response (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1=
gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3pjVxMgV03k8b58W7cn_8_7v6B5ZW=
29vd-d7d3WZrW4dfgSJ8Dwh_GW7KGdQ06lH1bTW55LQ-f3X7CbzW5LGcSx8CKpj4N8f-7w7Tn7n=
dW7l43bx8bgNB9VHgz8J4rNmfwW5Sfk6Y5zVZ5CVs_JNs5svGvxW6Gw3_P1Pg4kFVFQvXT5rGw8=
_W5NDycS9d6LMhW851Th24-wrWcW6TFN5M79VgrFW5Lfdyf1XkWW7W8b5C0J2-fqb0W8LTJs-4M=
Q1bjW3-2Rw95L1W6GN519_l7Xt4K4W8QghBz1wfDM3N3NxBpBx1LXGW5G6DqH981YhtN65lqMBz=
tcY_f5p0w_q04 ) site cleanings. However, this time we found a successful at=
tempt to directly inject a WordPress administrator account, one of the few =
we've been able to definitively attribute to this technique with the eviden=
ce still preserved.

Wordfence Premium (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3n0W6MQjSm1wtR4SW17t=
5TV53hdpdW2yhVs48WgZ7-W99Dr8f7QVR9WMwKRvLZ28RBW1vtNBH68BWJzW5p3Cvd6qdyZhW7Y=
9qg796NpfRN90-QfJX-HNHW4zsT489hHCT8W2tG8MY5t79N7W81wjF021RhtpW73V_bv4SM6mXV=
VnTqY6yrFs5N15WMRsbRbZMN72HgNmdyLMPN85XpDrpv76GW1Y4TWF7-HD33W7kdJMY537yddW8=
-8LG364Mt00N8-wFdKJ88RGW17mVj98m6VStN7tZLTqnDwtmW7MLJg696D6NDW7g4Xtv8zDWpwW=
7wTXPn4QRrPGf6KlH2-04 ) , Wordfence Care (https://email.wordfence.com/e3t/C=
tc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT=
6lZ3lNN6f_M5mv9wfkW298QW62byC5cVzKR5L1gtKFTN2-v8-zqjcC2W7Vy4Sj3N4r3mW77DN1R=
1wTjPcN46fMFVZrNxrW2RxL7L2Y9zqZW51DKyr3H2pM_W8JNd2h1X0W79W5Y0jbY7G1s94W2rjz=
0D1SjVnfM-xyhp43t15VYn1Yh74GnSlVyClF16tywTBW91RgM628H1JPW2pDv0B6ldthGW6J22C=
B7gX0b7W5FKX1m2v3PhxV60-kd6xxL9zW29qWMz1H27tFW2pm4-c1kNG6yW96x3bd4PJ7D8W8ZK=
KMS5y2dpTN2-zXHkwJTsjN426ZkVfk2pMf1rPVP804 ) , and Wordfence Response (http=
s://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5G=
RJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35W8JkWj-2znBsMW4fYCb914Ht6MW=
2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_vB4W96VBD38yVLbLW11YbP-51h9l=
sW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3LB6ZLN6Qpj9J2QsZzW5ZZdGD3px=
61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh64cNPs0W4PxZvZ9f8hc7W7sqfb71=
whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJz35xf9VjW8DJG-G4LNY3pf1wKZc=
F04 ) , along with Wordfence CLI Paid (https://email.wordfence.com/e3t/Ctc/=
GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ=
3kvW5vc6Xl486wJPW2qgGBH4MBbnnW8XljPq2D_XGvN3T8bl0TmDHLW8sL-Z-4fj7g6W8zQtmx1=
8ckWCW1-lMT66xJlG_W2l3Br_55VDgvW4WDRtl521TvYW6ZV8Rr2r9XQcW4KpcjR7H23zXW8WpH=
TY6rvYlnW3gpL5454frd1W9llS6_4-DpKbW4LSvjP42whPzW8G0sFb5TKCnkVgdFZT349SsRW35=
RbM7606bG8W6Cx7tc2qh8mWW8yqJvq5xMP8tW3K1HKY2Vs4KWVLT3qB503lsqW2q2H355HkQ03M=
2JPM-CWpV4W4wZ-Xr8SZL-bW7RrC5c8yHfSgf19Qfrv04 )  users received a malware s=
ignature to detect this malicious file on January 11th, 2024. Wordfence fre=
e users will receive this signature after 30 days on February 11th, 2024. I=
n addition, Wordfence Premium (https://email.wordfence.com/e3t/Ctc/GC+113/c=
wG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3n0W6MQj=
Sm1wtR4SW17t5TV53hdpdW2yhVs48WgZ7-W99Dr8f7QVR9WMwKRvLZ28RBW1vtNBH68BWJzW5p3=
Cvd6qdyZhW7Y9qg796NpfRN90-QfJX-HNHW4zsT489hHCT8W2tG8MY5t79N7W81wjF021RhtpW7=
3V_bv4SM6mXVVnTqY6yrFs5N15WMRsbRbZMN72HgNmdyLMPN85XpDrpv76GW1Y4TWF7-HD33W7k=
dJMY537yddW8-8LG364Mt00N8-wFdKJ88RGW17mVj98m6VStN7tZLTqnDwtmW7MLJg696D6NDW7=
g4Xtv8zDWpwW7wTXPn4QRrPGf6KlH2-04 ) , Wordfence Care (https://email.wordfen=
ce.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn=
3prCCW7Y8-PT6lZ3lNN6f_M5mv9wfkW298QW62byC5cVzKR5L1gtKFTN2-v8-zqjcC2W7Vy4Sj3=
N4r3mW77DN1R1wTjPcN46fMFVZrNxrW2RxL7L2Y9zqZW51DKyr3H2pM_W8JNd2h1X0W79W5Y0jb=
Y7G1s94W2rjz0D1SjVnfM-xyhp43t15VYn1Yh74GnSlVyClF16tywTBW91RgM628H1JPW2pDv0B=
6ldthGW6J22CB7gX0b7W5FKX1m2v3PhxV60-kd6xxL9zW29qWMz1H27tFW2pm4-c1kNG6yW96x3=
bd4PJ7D8W8ZKKMS5y2dpTN2-zXHkwJTsjN426ZkVfk2pMf1rPVP804 ) , and Wordfence Re=
sponse (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gz=
qD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35W8JkWj-2znBsMW4=
fYCb914Ht6MW2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_vB4W96VBD38yVLbL=
W11YbP-51h9lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3LB6ZLN6Qpj9J2Qs=
ZzW5ZZdGD3px61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh64cNPs0W4PxZvZ9f=
8hc7W7sqfb71whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJz35xf9VjW8DJG-G=
4LNY3pf1wKZcF04 ) , along with those still using the free version, are prot=
ected against any exploits targeting this vulnerability.

If you believe your site has been compromised as a result of this vulnerabi=
lity or any other vulnerability, we offer Incident Response services via Wo=
rdfence Care (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD=
9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3lNN6f_M5mv9wfkW298QW62by=
C5cVzKR5L1gtKFTN2-v8-zqjcC2W7Vy4Sj3N4r3mW77DN1R1wTjPcN46fMFVZrNxrW2RxL7L2Y9=
zqZW51DKyr3H2pM_W8JNd2h1X0W79W5Y0jbY7G1s94W2rjz0D1SjVnfM-xyhp43t15VYn1Yh74G=
nSlVyClF16tywTBW91RgM628H1JPW2pDv0B6ldthGW6J22CB7gX0b7W5FKX1m2v3PhxV60-kd6x=
xL9zW29qWMz1H27tFW2pm4-c1kNG6yW96x3bd4PJ7D8W8ZKKMS5y2dpTN2-zXHkwJTsjN426ZkV=
fk2pMf1rPVP804 ) . If you need your site cleaned immediately, Wordfence Res=
ponse (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzq=
D792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35W8JkWj-2znBsMW4f=
YCb914Ht6MW2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_vB4W96VBD38yVLbLW=
11YbP-51h9lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3LB6ZLN6Qpj9J2QsZ=
zW5ZZdGD3px61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh64cNPs0W4PxZvZ9f8=
hc7W7sqfb71whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJz35xf9VjW8DJG-G4=
LNY3pf1wKZcF04 )  offers the same service with 24/7/365 availability and a =
1-hour response time. Both these products include hands-on support in case =
you need further assistance.

CONTINUE READING ON THE BLOG
(https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh=
1NW5GRJ1L58n_ygN4qMxL45m_5PW7lCGcx6lZ3nVW2WyRK94Hy15FW8ygxCk3WyS_xW1HFwGP6t=
8dJRW5Jk8r04RS12KV7Pw8L18CbnPW6gBsQ-4mD60jVNPKjB8nNmSkW8SD5Cm3lHR5yVGKS1r3j=
s0zpW8m4rbX3vy9fCW6LNqWN7-X7JkW2nKsLG47NbWQW4Phy292rFNkBW2bnTln8HghpbMjhqWF=
bbP-1W8x35ld1t92V4W2h-QbF58FQ5sW4TmyG06Nx8B6W5lgr_X4Sbpc1W7SRJ_S6dVcR6W7lzD=
Gq7Lxd5LW4vwmY73wmP3lV7QYJZ829Rp7N3Bj3pFdmhr5W8lhT7Y1TCVmrW4w46Wm3NLF-rW8ng=
sCf4M9dVGW1VF9wD57QcHMW2_n1C93xxf5vW3mvVDn8SByT4W2hV2dz2T03GjW5hLBWC2Ks8Z6N=
5kWlDgHYt31W6HzwrS6VXK-rW25Fck98GfM2FW6whpTJ5QZWTNN5PjbrQGVN82W8k3GZ788tdt8=
W1J-LNR1QQ3QqW1-59RT8NKb5Hf72RkMd04 )

Detailing the Attack

The attack itself is quite straightforward. Once an attacker has identified=
 a vulnerable website, they use an unauthenticated HTTP request to inject m=
alicious code in the =E2=80=9CCustom JS=E2=80=9D options of the Popup Build=
er plugin:

curl [...] --data '[...]&sgpb-ShouldOpen=3D[payload]'

Screenshot-2024-01-11-alle-20.36.49-1024x259 (https://email.wordfence.com/e=
3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45m_5PW7l=
CGcx6lZ3nVW2WyRK94Hy15FW8ygxCk3WyS_xW1HFwGP6t8dJRW5Jk8r04RS12KV7Pw8L18CbnPW=
6gBsQ-4mD60jVNPKjB8nNmSkW8SD5Cm3lHR5yVGKS1r3js0zpW8m4rbX3vy9fCW6LNqWN7-X7Jk=
W2nKsLG47NbWQW4Phy292rFNkBW2bnTln8HghpbMjhqWFbbP-1W8x35ld1t92V4W2h-QbF58FQ5=
sW4TmyG06Nx8B6W5lgr_X4Sbpc1W7SRJ_S6dVcR6W7lzDGq7Lxd5LW4vwmY73wmP3lV7QYJZ829=
Rp7N3Bj3pFdmhr5W8lhT7Y1TCVmrW4w46Wm3NLF-rW8ngsCf4M9dVGW1VF9wD57QcHMW2_n1C93=
xxf5vW3mvVDn8SByT4W2hV2dz2T03GjW5hLBWC2Ks8Z6N5kWlDgHYt31W6HzwrS6VXK-rW25Fck=
98GfM2FW6whpTJ5QZWTNN5PjbrQGVN82W8k3GZ788tdt8W1J-LNR1QQ3QqW1-59RT8NKb5Hf72R=
kMd04 )

The custom JS code option itself is a peculiar =E2=80=93 and quite powerful=
 =E2=80=93 feature of the Popup builder plugin, which lets an administrator=
 run arbitrary JavaScript code in order to decide if a popup needs to be sh=
own or not. The implementation relies on the JavaScript eval() method, mean=
ing that this option field =E2=80=93 injectable with custom code by unauthe=
nticated attackers =E2=80=93 will happily run whatever code is found each t=
ime a user visits the website. Once an attacker is able to execute arbitrar=
y code with administrative privileges there are no longer limits to the pos=
sible actions that can be performed.

A recent blog post by Sucuri shows in detail how this vulnerability was use=
d to install a rogue plugin titled WP Felody =E2=80=93 we gathered the firs=
t data about it around the same time (December 14th, 2023) and found it was=
 already detected by one of our malware signatures. In this case we also fo=
und evidence of the same technique used to obtain a direct WordPress admini=
strative account injection. This is the source code in detail:

Screenshot-2024-01-11-alle-21.51.31 (https://email.wordfence.com/e3t/Ctc/GC=
+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45m_5PW7lCGcx6lZ3n=
VW2WyRK94Hy15FW8ygxCk3WyS_xW1HFwGP6t8dJRW5Jk8r04RS12KV7Pw8L18CbnPW6gBsQ-4mD=
60jVNPKjB8nNmSkW8SD5Cm3lHR5yVGKS1r3js0zpW8m4rbX3vy9fCW6LNqWN7-X7JkW2nKsLG47=
NbWQW4Phy292rFNkBW2bnTln8HghpbMjhqWFbbP-1W8x35ld1t92V4W2h-QbF58FQ5sW4TmyG06=
Nx8B6W5lgr_X4Sbpc1W7SRJ_S6dVcR6W7lzDGq7Lxd5LW4vwmY73wmP3lV7QYJZ829Rp7N3Bj3p=
Fdmhr5W8lhT7Y1TCVmrW4w46Wm3NLF-rW8ngsCf4M9dVGW1VF9wD57QcHMW2_n1C93xxf5vW3mv=
VDn8SByT4W2hV2dz2T03GjW5hLBWC2Ks8Z6N5kWlDgHYt31W6HzwrS6VXK-rW25Fck98GfM2FW6=
whpTJ5QZWTNN5PjbrQGVN82W8k3GZ788tdt8W1J-LNR1QQ3QqW1-59RT8NKb5Hf72RkMd04 )

There are some interesting insights in this code. Unlike most malware, this=
 source code is well structured and quite elegant, absolutely resembling le=
gitimate and high-quality code; the use of console debug statements is also=
 quite unusual.

Screenshot-2024-01-11-alle-20.40.39 (https://email.wordfence.com/e3t/Ctc/GC=
+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45m_5PW7lCGcx6lZ3n=
VW2WyRK94Hy15FW8ygxCk3WyS_xW1HFwGP6t8dJRW5Jk8r04RS12KV7Pw8L18CbnPW6gBsQ-4mD=
60jVNPKjB8nNmSkW8SD5Cm3lHR5yVGKS1r3js0zpW8m4rbX3vy9fCW6LNqWN7-X7JkW2nKsLG47=
NbWQW4Phy292rFNkBW2bnTln8HghpbMjhqWFbbP-1W8x35ld1t92V4W2h-QbF58FQ5sW4TmyG06=
Nx8B6W5lgr_X4Sbpc1W7SRJ_S6dVcR6W7lzDGq7Lxd5LW4vwmY73wmP3lV7QYJZ829Rp7N3Bj3p=
Fdmhr5W8lhT7Y1TCVmrW4w46Wm3NLF-rW8ngsCf4M9dVGW1VF9wD57QcHMW2_n1C93xxf5vW3mv=
VDn8SByT4W2hV2dz2T03GjW5hLBWC2Ks8Z6N5kWlDgHYt31W6HzwrS6VXK-rW25Fck98GfM2FW6=
whpTJ5QZWTNN5PjbrQGVN82W8k3GZ788tdt8W1J-LNR1QQ3QqW1-59RT8NKb5Hf72RkMd04 )

The actual exploit is contained in the body parameter of the fetch method f=
ound inside httpPost, which will be executed whenever a user visits the web=
site. As soon as a logged-in user with an administrator role is involved, t=
he script will run an HTTP request to create a rogue admin account =E2=80=
=93 identical to a legitimate one =E2=80=93 and send the new credentials to=
 a website controlled by the attacker.

Screenshot-2024-01-11-alle-19.08.56-e1705325917959 (https://email.wordfence=
.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45m=
_5PW7lCGcx6lZ3nVW2WyRK94Hy15FW8ygxCk3WyS_xW1HFwGP6t8dJRW5Jk8r04RS12KV7Pw8L1=
8CbnPW6gBsQ-4mD60jVNPKjB8nNmSkW8SD5Cm3lHR5yVGKS1r3js0zpW8m4rbX3vy9fCW6LNqWN=
7-X7JkW2nKsLG47NbWQW4Phy292rFNkBW2bnTln8HghpbMjhqWFbbP-1W8x35ld1t92V4W2h-Qb=
F58FQ5sW4TmyG06Nx8B6W5lgr_X4Sbpc1W7SRJ_S6dVcR6W7lzDGq7Lxd5LW4vwmY73wmP3lV7Q=
YJZ829Rp7N3Bj3pFdmhr5W8lhT7Y1TCVmrW4w46Wm3NLF-rW8ngsCf4M9dVGW1VF9wD57QcHMW2=
_n1C93xxf5vW3mvVDn8SByT4W2hV2dz2T03GjW5hLBWC2Ks8Z6N5kWlDgHYt31W6HzwrS6VXK-r=
W25Fck98GfM2FW6whpTJ5QZWTNN5PjbrQGVN82W8k3GZ788tdt8W1J-LNR1QQ3QqW1-59RT8NKb=
5Hf72RkMd04 )

Indicators of Compromise

- An administrative user account with the username wpx or email waterstyle2=
9@gmail[.]com
- Presence of wp-felody WordPress plugin

Timeline

- December 1st, 2023: First occurrence of wpemojii[.]com in WTI
- December 7th, 2023: Popup Builder 4.2.3 released
- December 11th, 2023: Vulnerability in Popup Builder Disclosed (https://em=
ail.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58=
n_ygN4qMxKP5m_5PW6N1X8z6lZ3pmN5NJFl1SW6H0W4p3FbV5jLdD8W6BMmTd9bnwJmW8w73KV1=
STRJ3W8080Jc7r8C5ZW487sf-36RCDlW3LN7f77Y0J1rVLnTrX1pVk5hW63FTWH1H-6lwW7rMnj=
07KLm9VW4Z-dH76_lZG5VWGVX45XTXphN2bGDmt5d_hLW5ZfK5g2L9XMnW2SSGBN73V1HTW4gNb=
j97NTb0pW5fzCnp4r4QkdW2WfvDL6S3wJ0N2RmTwlcxSQLW5H4dzw38SY1_W8cXHwb3Wr2hLW1v=
kGzg6KM0WnW6Mw6Fb8HLXxgW1pC8MB4B1G8qW37pS1D209xWFW4_qwQW1-3T8wW1pWt-J4-y8nt=
W6PsKc96F-RybN56cDVTKMsL7W1226C21CSH9BW8WYvjG6KYxZZW18dMhp5zp4s9VdlpsB62nS2=
JN92nHZ1pyQphV-jJVr7jJRl4W2TVq7n3XXprpW74nCRX6-KdYxVcz4gN5Wc2-Df1FtHs804 )
- January 1st, 2024: Exploit Proof of Concept (https://email.wordfence.com/=
e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLH3prCCW8=
wLKSR6lZ3pjW51D4mq6Hv7NjW8HhNT05Ys8y4VmSqV856PV9PW38Sybs4dGDp6W73Qmhw5hvMQw=
N4235m4HvzfwW8nLzwr8Wzqy0Vn7Lg21-L0QDW58Zx6h3WByftW5yjxLH21xpLfW2mDtmF6cbZ3=
lW94RcSz1_rbSXW2x4P2f2SY4m5N8hHttZ33j4PW3hhp846_MBtqW1bPFGK1860SFW6-SmZY8l1=
WKbW3qWZYN5TNQtyW7-9tJG5clkw0W7SFyHq6f3swtW7jTxhv8J2XMTW4mLlLQ529mfwW5zZQ-K=
4Dvv_XW5WD0bc54tr_7N7dKWbqjBnn2W528wCl8xgM66W68brwS7S_NSXW5rDKgH4-PVrxf4wq-=
M004 )  released on WPScan
- January 9th, 2024: Forum post (https://email.wordfence.com/e3t/Ctc/GC+113=
/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLH3prCCW8wLKSR6lZ3nWW5Y=
3LxZ9bZtM4W4DTLxB1-l6mRW7skK1c6gbQJ0VpSWNn7ZmJp1N1FtYP4tLLprW5bkPJ35mJmT6W3=
yrHBx8yJfL1V9cxnH1d8j9HW619NXN1KkJjRW9hT7_m6C2RmxN62gnYLLkGX2W1bfmM_7Sx2BsW=
6p-KTg1JTpfXW23KyPq6hqj-FN6bScvMqS461V8XjGH4-mBznVM-J5P6hxXxYW5svP4D4Z4LZfV=
HwdwG1kFY3hW3q-Y_J8HksyvW69vsDc5RCVTbW1-WDqD8sv6X3W1W2M7Q91qG95W6LpYC-5kxQg=
RW87ZTyQ7t7VfzW4sgNQP5whRk6W6Pw1dg7LRt2cW94Kn0491WSk-f5KCSmP04 ) referencin=
g =E2=80=98a virus=E2=80=99 on wordpress[.]org
- January 10th, 2024: Source code used in the injection shared to us. Malwa=
re signature developed to provide detection and protection from any attacke=
rs trying to inject this malware.
- January 11th, 2024: Malware signature pushed to production after testing.=
 Wordfence Premium (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJ=
bg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3n0W6MQjSm1wtR4SW17=
t5TV53hdpdW2yhVs48WgZ7-W99Dr8f7QVR9WMwKRvLZ28RBW1vtNBH68BWJzW5p3Cvd6qdyZhW7=
Y9qg796NpfRN90-QfJX-HNHW4zsT489hHCT8W2tG8MY5t79N7W81wjF021RhtpW73V_bv4SM6mX=
VVnTqY6yrFs5N15WMRsbRbZMN72HgNmdyLMPN85XpDrpv76GW1Y4TWF7-HD33W7kdJMY537yddW=
8-8LG364Mt00N8-wFdKJ88RGW17mVj98m6VStN7tZLTqnDwtmW7MLJg696D6NDW7g4Xtv8zDWpw=
W7wTXPn4QRrPGf6KlH2-04 ) , Wordfence Care (https://email.wordfence.com/e3t/=
Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-P=
T6lZ3lNN6f_M5mv9wfkW298QW62byC5cVzKR5L1gtKFTN2-v8-zqjcC2W7Vy4Sj3N4r3mW77DN1=
R1wTjPcN46fMFVZrNxrW2RxL7L2Y9zqZW51DKyr3H2pM_W8JNd2h1X0W79W5Y0jbY7G1s94W2rj=
z0D1SjVnfM-xyhp43t15VYn1Yh74GnSlVyClF16tywTBW91RgM628H1JPW2pDv0B6ldthGW6J22=
CB7gX0b7W5FKX1m2v3PhxV60-kd6xxL9zW29qWMz1H27tFW2pm4-c1kNG6yW96x3bd4PJ7D8W8Z=
KKMS5y2dpTN2-zXHkwJTsjN426ZkVfk2pMf1rPVP804 ) , and Wordfence Response (htt=
ps://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5=
GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35W8JkWj-2znBsMW4fYCb914Ht6M=
W2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_vB4W96VBD38yVLbLW11YbP-51h9=
lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3LB6ZLN6Qpj9J2QsZzW5ZZdGD3p=
x61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh64cNPs0W4PxZvZ9f8hc7W7sqfb7=
1whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJz35xf9VjW8DJG-G4LNY3pf1wKZ=
cF04 )  customers, along with Wordfence CLI Paid (https://email.wordfence.c=
om/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prC=
CW7Y8-PT6lZ3kvW5vc6Xl486wJPW2qgGBH4MBbnnW8XljPq2D_XGvN3T8bl0TmDHLW8sL-Z-4fj=
7g6W8zQtmx18ckWCW1-lMT66xJlG_W2l3Br_55VDgvW4WDRtl521TvYW6ZV8Rr2r9XQcW4KpcjR=
7H23zXW8WpHTY6rvYlnW3gpL5454frd1W9llS6_4-DpKbW4LSvjP42whPzW8G0sFb5TKCnkVgdF=
ZT349SsRW35RbM7606bG8W6Cx7tc2qh8mWW8yqJvq5xMP8tW3K1HKY2Vs4KWVLT3qB503lsqW2q=
2H355HkQ03M2JPM-CWpV4W4wZ-Xr8SZL-bW7RrC5c8yHfSgf19Qfrv04 )  users, receive =
malware signature.
- February 11th, 2024: Wordfence free users receive malware signature.

Conclusion

In this blog post we detailed an unusual direct WordPress administrative ac=
count injection method based on a Unauthenticated Cross-Site Scripting vuln=
erability exposed by the Popup Builder plugin affecting versions 4.2.2 and =
earlier. This method allows unauthenticated threat actors to add a rogue Wo=
rdPress admin account, resulting in a full website takeover. The vulnerabil=
ity appears to be addressed in version 4.2.3 of the plugin.

As a reminder, Wordfence Premium (https://email.wordfence.com/e3t/Ctc/GC+11=
3/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3n0W6=
MQjSm1wtR4SW17t5TV53hdpdW2yhVs48WgZ7-W99Dr8f7QVR9WMwKRvLZ28RBW1vtNBH68BWJzW=
5p3Cvd6qdyZhW7Y9qg796NpfRN90-QfJX-HNHW4zsT489hHCT8W2tG8MY5t79N7W81wjF021Rht=
pW73V_bv4SM6mXVVnTqY6yrFs5N15WMRsbRbZMN72HgNmdyLMPN85XpDrpv76GW1Y4TWF7-HD33=
W7kdJMY537yddW8-8LG364Mt00N8-wFdKJ88RGW17mVj98m6VStN7tZLTqnDwtmW7MLJg696D6N=
DW7g4Xtv8zDWpwW7wTXPn4QRrPGf6KlH2-04 ) , Wordfence Care (https://email.word=
fence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qM=
xLn3prCCW7Y8-PT6lZ3lNN6f_M5mv9wfkW298QW62byC5cVzKR5L1gtKFTN2-v8-zqjcC2W7Vy4=
Sj3N4r3mW77DN1R1wTjPcN46fMFVZrNxrW2RxL7L2Y9zqZW51DKyr3H2pM_W8JNd2h1X0W79W5Y=
0jbY7G1s94W2rjz0D1SjVnfM-xyhp43t15VYn1Yh74GnSlVyClF16tywTBW91RgM628H1JPW2pD=
v0B6ldthGW6J22CB7gX0b7W5FKX1m2v3PhxV60-kd6xxL9zW29qWMz1H27tFW2pm4-c1kNG6yW9=
6x3bd4PJ7D8W8ZKKMS5y2dpTN2-zXHkwJTsjN426ZkVfk2pMf1rPVP804 ) , and Wordfence=
 Response (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W=
1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35W8JkWj-2znBs=
MW4fYCb914Ht6MW2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_vB4W96VBD38yV=
LbLW11YbP-51h9lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3LB6ZLN6Qpj9J=
2QsZzW5ZZdGD3px61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh64cNPs0W4PxZv=
Z9f8hc7W7sqfb71whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJz35xf9VjW8DJ=
G-G4LNY3pf1wKZcF04 ) , along with Wordfence CLI Paid (https://email.wordfen=
ce.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn=
3prCCW7Y8-PT6lZ3kvW5vc6Xl486wJPW2qgGBH4MBbnnW8XljPq2D_XGvN3T8bl0TmDHLW8sL-Z=
-4fj7g6W8zQtmx18ckWCW1-lMT66xJlG_W2l3Br_55VDgvW4WDRtl521TvYW6ZV8Rr2r9XQcW4K=
pcjR7H23zXW8WpHTY6rvYlnW3gpL5454frd1W9llS6_4-DpKbW4LSvjP42whPzW8G0sFb5TKCnk=
VgdFZT349SsRW35RbM7606bG8W6Cx7tc2qh8mWW8yqJvq5xMP8tW3K1HKY2Vs4KWVLT3qB503ls=
qW2q2H355HkQ03M2JPM-CWpV4W4wZ-Xr8SZL-bW7RrC5c8yHfSgf19Qfrv04 )  users recei=
ved a malware signature to detect this malicious file on January 11th, 2024=
. Wordfence free users will receive this signature after 30 days on Februar=
y 11th, 2024. In addition, Wordfence Premium (https://email.wordfence.com/e=
3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y=
8-PT6lZ3n0W6MQjSm1wtR4SW17t5TV53hdpdW2yhVs48WgZ7-W99Dr8f7QVR9WMwKRvLZ28RBW1=
vtNBH68BWJzW5p3Cvd6qdyZhW7Y9qg796NpfRN90-QfJX-HNHW4zsT489hHCT8W2tG8MY5t79N7=
W81wjF021RhtpW73V_bv4SM6mXVVnTqY6yrFs5N15WMRsbRbZMN72HgNmdyLMPN85XpDrpv76GW=
1Y4TWF7-HD33W7kdJMY537yddW8-8LG364Mt00N8-wFdKJ88RGW17mVj98m6VStN7tZLTqnDwtm=
W7MLJg696D6NDW7g4Xtv8zDWpwW7wTXPn4QRrPGf6KlH2-04 ) , Wordfence Care (https:=
//email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ=
1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3lNN6f_M5mv9wfkW298QW62byC5cVzKR5L1gtKFTN2-v8=
-zqjcC2W7Vy4Sj3N4r3mW77DN1R1wTjPcN46fMFVZrNxrW2RxL7L2Y9zqZW51DKyr3H2pM_W8JN=
d2h1X0W79W5Y0jbY7G1s94W2rjz0D1SjVnfM-xyhp43t15VYn1Yh74GnSlVyClF16tywTBW91Rg=
M628H1JPW2pDv0B6ldthGW6J22CB7gX0b7W5FKX1m2v3PhxV60-kd6xxL9zW29qWMz1H27tFW2p=
m4-c1kNG6yW96x3bd4PJ7D8W8ZKKMS5y2dpTN2-zXHkwJTsjN426ZkVfk2pMf1rPVP804 ) , a=
nd Wordfence Response (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/V=
VTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35=
W8JkWj-2znBsMW4fYCb914Ht6MW2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_v=
B4W96VBD38yVLbLW11YbP-51h9lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3=
LB6ZLN6Qpj9J2QsZzW5ZZdGD3px61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh6=
4cNPs0W4PxZvZ9f8hc7W7sqfb71whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJ=
z35xf9VjW8DJG-G4LNY3pf1wKZcF04 ) , along with those still using the free ve=
rsion, are protected against any exploits targeting this vulnerability.

This is significantly more sophisticated than previous scripts we=E2=80=99v=
e seen making use of this method, which typically make blind attempts to cr=
eate administrator accounts when any logged-in user loads the script, regar=
dless of their role.

In the cases we were able to find, the attacker=E2=80=99s domain was always=
 wpemojii[.]com, which was added to our Threat Intelligence malicious domai=
ns database as of 12/1/2023 after unrelated findings. We found the first kn=
own mention of the current issue in a WordPress.org Support forum topic whi=
ch suggests at least one other user was aware of the related intrusion befo=
re 1/9/24; this is indeed compatible with an active exploitation campaign g=
oing on since early December 2023. The Popup Builder plugin has had 7 relea=
ses over the last 3 months, 5 of which were security-related.

If you believe your site has been compromised as a result of this vulnerabi=
lity or any other vulnerability, we offer Incident Response services via Wo=
rdfence Care (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD=
9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3lNN6f_M5mv9wfkW298QW62by=
C5cVzKR5L1gtKFTN2-v8-zqjcC2W7Vy4Sj3N4r3mW77DN1R1wTjPcN46fMFVZrNxrW2RxL7L2Y9=
zqZW51DKyr3H2pM_W8JNd2h1X0W79W5Y0jbY7G1s94W2rjz0D1SjVnfM-xyhp43t15VYn1Yh74G=
nSlVyClF16tywTBW91RgM628H1JPW2pDv0B6ldthGW6J22CB7gX0b7W5FKX1m2v3PhxV60-kd6x=
xL9zW29qWMz1H27tFW2pm4-c1kNG6yW96x3bd4PJ7D8W8ZKKMS5y2dpTN2-zXHkwJTsjN426ZkV=
fk2pMf1rPVP804 ) . If you need your site cleaned immediately, Wordfence Res=
ponse (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzq=
D792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35W8JkWj-2znBsMW4f=
YCb914Ht6MW2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_vB4W96VBD38yVLbLW=
11YbP-51h9lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3LB6ZLN6Qpj9J2QsZ=
zW5ZZdGD3px61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh64cNPs0W4PxZvZ9f8=
hc7W7sqfb71whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJz35xf9VjW8DJG-G4=
LNY3pf1wKZcF04 )  offers the same service with 24/7/365 availability and a =
1-hour response time. Both these products include hands-on support in case =
you need further assistance.

Special thanks to Roberto Garaffa / 19[.]coop who reported the code injecti=
on sample to us.

The Full Product Lineup

wf-stacked-free-1 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3kWV-sr-S3pD5PFW14NM=
mz58qKPLW19vvml5JfZYDW4NPMmr6VS3GbW41PjMV2qBj-3VG8Fzp6HpYxhW1GD5wx7pN3ZPVrL=
H3Y8Crgp0VmLZDs93hC0pW4FDzjN9k30CmW7B22FP5RhTG4W4c2hH829YyrjW5_Mcbs4SK7j6V_=
bN8M1plZlhW4X_dK34LQ_sBN2x2r5VDwdHhW1QhRfs25s7NgW6ZWJHK4fzqnNN6JBwb2xWr71W1=
6NPmt6C4s6fW2CDMb-4q7sc_W4Jth7C2rsDDdW7wTv5m2WdlB1VJqzz_7z5p09W3ySM7R7v_Yhd=
VZ3yQ01BqK06f3hl5FC04 )

wf-stacked-premium-1 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VV=
TJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3m9W4rV87h5Ph-MGT=
9npV8wJL70W5C3gvj50GZR1MrS4SwHmsmZN57m3z77xMF9W2x8PT71ptQ_jN1pYjdF3dk7FW7Gy=
lCT64dPYZW5kRqRw5wH328W8ZMkRP2w6s58VbrJ3s1Q569hW9lcHQT73wbc8W21MFQ97QMxM9W8=
GSprF6Nd86KW2vnsNK6BvhdDW6H7bFq8W36fQW3QYyP71Fm9TZW37sG1w2jrC0zW8Klrns7Mw5J=
WVr12HT6pvYD0VPFz5Q1Tw5kSW3DYsZt4CRrKQW5z9ZJg2Fq7K1VR2lBg50zsmdW2D9nl455x10=
-W6cQRXZ4fhF7qf2pc-MM04 )

wf-stacked-care-3 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3lpW2C2PFg2dyC-cN321=
4LQdTPr9VGXPyq4kGTg7W7MYDB-5nNzj_W6vFxSB2z8HCMW5t9pXt4RmMTdW71fyFb23Pz-CW91=
ww338LX2K1N1pQpkkwBVVPW2K7JQh2YXKwZW2tzSZV6wGp8JVT1Tk78_h8bDW4bG5Wd3y-3w6Vh=
kSwv4HNHXtVBfhtF6ZJGz5F6cp6-Xqz_HW2GFnX397-bq2W5XPTKH1q5nZjW6QMz4h485Bx1W3S=
tr_K95Wzz1W6_MDls7nd9QCW7fzfrJ2SbrdJW45LVpD5NBXy4LHjhVgnX_3W31R3lx2jgtgRN3J=
1bntCMlt-f3Hpb8j04 )

wf-stacked-response-2 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/V=
VTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3krW48blKx9jZW35=
W8JkWj-2znBsMW4fYCb914Ht6MW2YqXyW1HX6XwW4cZccH4321g8W7ZqX5T4R5q7qN3ZXK7c5_v=
B4W96VBD38yVLbLW11YbP-51h9lsW6F0NZz2kDMlcW76KXql1N5Y9wW57F7kP46mLtfW1tLGbw3=
LB6ZLN6Qpj9J2QsZzW5ZZdGD3px61wN799FKrxx9YmW1M4tRf4Rv_lgW7MTV9C57bBxhW2Z8mh6=
4cNPs0W4PxZvZ9f8hc7W7sqfb71whz20W6lhMjj8THrtxVP6_6N1kKpRwW89x2Jy1qy8p6W79ZJ=
z35xf9VjW8DJG-G4LNY3pf1wKZcF04 )

wf-stacked-cli (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2M=
QD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3prCCW7Y8-PT6lZ3kvW5vc6Xl486wJPW2qgGBH=
4MBbnnW8XljPq2D_XGvN3T8bl0TmDHLW8sL-Z-4fj7g6W8zQtmx18ckWCW1-lMT66xJlG_W2l3B=
r_55VDgvW4WDRtl521TvYW6ZV8Rr2r9XQcW4KpcjR7H23zXW8WpHTY6rvYlnW3gpL5454frd1W9=
llS6_4-DpKbW4LSvjP42whPzW8G0sFb5TKCnkVgdFZT349SsRW35RbM7606bG8W6Cx7tc2qh8mW=
W8yqJvq5xMP8tW3K1HKY2Vs4KWVLT3qB503lsqW2q2H355HkQ03M2JPM-CWpV4W4wZ-Xr8SZL-b=
W7RrC5c8yHfSgf19Qfrv04 )

wf-stacked-intelligence (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04=
/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL43prCCW7lCdLW6lZ3kyW4by6Pw8CrV=
JJW6YBj8r5--b6-W4KVdC91s7Y2-W3q14gL272QLjVLr7Rt8cSWTMW5wCLZ94z4yKRVBmHk78TF=
0pKVzK7Yg7xzy2pW3fLfpZ2MskxBW5nGWB51mSnsYW37dPvR547dYhW4xQNcm53gSbPW2t3kbz9=
4w4C2V3TTkj88KjyPW4b0_PT3lrVS0W2Wht5C3Dd_YvW1_PDBY1T8WYrW1z3nsh4bGJyDN7JRMq=
mvMTGTW2nTJzQ7RwVZZV-R60l7Sx7y2W2tWVdr4WBjScW204M6d7bF2bkW8bm1gT59gb5Lf1CBh=
fz04 )

logo-defiant (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD=
9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP3prCCW6N1vHY6lZ3pqVL5wj15CsCGDVHwllW5PFd=
dYW4dWwCH2KsDN3W2c__Sl40CHzFW6rHBkb68_7PQW8q9Y_T5Q-B6mW1hY6Rl2sK40kW6nQGd66=
6Mpg7W78MWTr7SDM9zW65bbNZ2jpLjbVRC9Gc1BMkKgW2nBSXh4Nxz-HW4g6rvx4N-B3FW5xbRd=
X3my2cBVLgDzX7Yblw_W6PRCZT3hNhnFW7R6SQs2tX9x1W1MyZQB3Q4W9SW4l319h7P3Mh2W2N0=
Fm58pC5KPW9cW-gv94zXZPW6X3HzX1lrwN6dTD6kv04 )

Defiant, Inc., 1700 Westlake Ave N STE 200

Seattle, WA  98109 United States

Unsubscribe (https://email.wordfence.com/hs/manage-preferences/unsubscribe-=
all?languagePreference=3Den&d=3DVnbshC892TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29f=
m6J4V3WVmWcMV4ZKBH8N6-bxzc25tmTW4McwsJ92BG4RW96PdFZ7FMD3mV1yf0N2_-c9NW7wYvv=
s6byRJlW2nY5GL4fwh5s22M3&v=3D3&_hsenc=3Dp2ANqtz-8YZ84HejK-nf2eSpRro1ey9icOi=
4M3uzfVFRFg4d9WzwiTLG4qAYqh9xlrydt3W-ag4ZuFs4HoYj25UItiloUKZ9YLlw&_hsmi=3D2=
90340505 ) Manage Preferences (https://email.wordfence.com/hs/manage-prefer=
ences/unsubscribe?languagePreference=3Den&d=3DVnbshC892TtnVCnbkg45v0QyW3_X4=
wv3SXQ-tW4h29fm6J4V3WVmWcMV4ZKBH8N6-bxzc25tmTW4McwsJ92BG4RW96PdFZ7FMD3mV1yf=
0N2_-c9NW7wYvvs6byRJlW2nY5GL4fwh5s22M3&v=3D3&_hsenc=3Dp2ANqtz-8YZ84HejK-nf2=
eSpRro1ey9icOi4M3uzfVFRFg4d9WzwiTLG4qAYqh9xlrydt3W-ag4ZuFs4HoYj25UItiloUKZ9=
YLlw&_hsmi=3D290340505 )

ISO_27001 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W=
1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP3prCCW6N1vHY6lZ3mnW7GYzwP2lFXjzW2LST-R4TltZ=
CW6stkrX6GdvvvW4HP6rj36S9mKVjpzSS1TRTHHN7qZWZlQ7W_9W8lX04w392mbhVxmT4d1DkWq=
TW8Rqk941ZbKtfW4Tz9tM6VRh0-W3_H4Yj1gn0tpW7BL5Zq2l5C9lW8-TJR743X0cXW6xXgfg39=
4j3MW1Gy_hm5yD7xLW1l497f3Qd9n8W96w_8D96ysT2W8DQXtl4NKgrGN8f9gV8V_j-XW5GMhNX=
84fQRtVXx-zd3D4c9TVB_ZNt7ckJNVf5v_9PM04 )

You're receiving this email because you signed up for Wordfence's WordPress=
 security mailing list.
------=_Part_3216850_1529249456.1705503945122
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional //EN" "http://www=
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns=3D"http://www.w3=
.org/1999/xhtml" xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:=
v=3D"urn:schemas-microsoft-com:vml" lang=3D"en"><head>
    <title>[WordPress Security] Website Takeover Campaign Takes Advantage o=
f Unauthenticated Stored Cross-Site Scripting Vulnerability in Popup Builde=
r Plugin</title>
    <meta property=3D"og:title" content=3D"[WordPress Security] Website Tak=
eover Campaign Takes Advantage of Unauthenticated Stored Cross-Site Scripti=
ng Vulnerability in Popup Builder Plugin">
    <meta name=3D"twitter:title" content=3D"[WordPress Security] Website Ta=
keover Campaign Takes Advantage of Unauthenticated Stored Cross-Site Script=
ing Vulnerability in Popup Builder Plugin">
   =20
   =20
   =20
<meta name=3D"x-apple-disable-message-reformatting">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
<meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.=
0">
    <!--[if gte mso 9]>
  <xml>
      <o:OfficeDocumentSettings>
      <o:AllowPNG/>
      <o:PixelsPerInch>96</o:PixelsPerInch>
      </o:OfficeDocumentSettings>
  </xml>
 =20
  <style>
    ul > li {
      text-indent: -1em;
    }
  </style>
<![endif]-->
<!--[if mso]>
<style type=3D"text/css">
 body, td {font-family: Arial, Helvetica, sans-serif;}
 .hse-body-wrapper-table {background-color: #FFFFFF;padding: 20px 0 !import=
ant}
</style>
<![endif]-->
   =20
     =20
   =20
  <meta name=3D"generator" content=3D"HubSpot"><meta property=3D"og:url" co=
ntent=3D"https://email.wordfence.com/-temporary-slug-de5c074e-bbf9-480c-993=
e-a76f20e6914f"><meta name=3D"robots" content=3D"noindex,follow"><!--[if !(=
(mso)|(IE))]><!-- --><style type=3D"text/css">.moz-text-html .hse-column-co=
ntainer{max-width:600px !important;width:600px !important}
.moz-text-html .hse-column{display:table-cell;vertical-align:top}.moz-text-=
html .hse-section .hse-size-4{max-width:200px !important;width:200px !impor=
tant}
.moz-text-html .hse-section .hse-size-8{max-width:400px !important;width:40=
0px !important}
.moz-text-html .hse-section .hse-size-12{max-width:600px !important;width:6=
00px !important}
@media only screen and (min-width:640px){.hse-column-container{max-width:60=
0px !important;width:600px !important}
.hse-column{display:table-cell;vertical-align:top}.hse-section .hse-size-4{=
max-width:200px !important;width:200px !important}
.hse-section .hse-size-8{max-width:400px !important;width:400px !important}=
.hse-section .hse-size-12{max-width:600px !important;width:600px !important=
}
}@media only screen and (max-width:639px){img.stretch-on-mobile,.hs_rss_ema=
il_entries_table img,.hs-stretch-cta .hs-cta-img{height:auto !important;wid=
th:100% !important}
.display_block_on_small_screens{display:block}.hs_padded{padding-left:20px =
!important;padding-right:20px !important}
ul,blockquote{margin:0;padding:1em 40px} }</style><!--<![endif]--><style ty=
pe=3D"text/css">#hs_body #hs_cos_wrapper_main a[x-apple-data-detectors]{col=
or:inherit !important;text-decoration:none !important;font-size:inherit !im=
portant;font-family:inherit !important;font-weight:inherit !important;line-=
height:inherit !important}
a{text-decoration:underline}p{margin:0}body{-ms-text-size-adjust:100%;-webk=
it-text-size-adjust:100%;-webkit-font-smoothing:antialiased;moz-osx-font-sm=
oothing:grayscale}</style></head>
  <body id=3D"hs_body" bgcolor=3D"#FFFFFF" style=3D"margin:0 !important; pa=
dding:0 !important; font-family:Arial, sans-serif; font-size:15px; color:#5=
25355; word-break:break-word">
    <div id=3D"preview_text" style=3D"display:none;font-size:1px;color:#FFF=
FFF;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;=
" lang=3D"en">Attackers are leveraging XSS to inject administrative user ac=
counts and takeover sites.</div>
   =20
<!--[if gte mso 9]>
<v:background xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"t">
    <v:fill type=3D"tile" size=3D"100%,100%" color=3D"#ffffff"/>
</v:background>
<![endif]-->
    <div class=3D"hse-body-background" lang=3D"en" style=3D"background-colo=
r:#ffffff" bgcolor=3D"#ffffff">
      <table role=3D"presentation" class=3D"hse-body-wrapper-table" cellpad=
ding=3D"0" cellspacing=3D"0" style=3D"border-spacing:0 !important; border-c=
ollapse:collapse; mso-table-lspace:0pt; mso-table-rspace:0pt; margin:0; pad=
ding:0; width:100% !important; min-width:320px !important; height:100% !imp=
ortant" width=3D"100%" height=3D"100%">
        <tbody><tr>
          <td class=3D"hse-body-wrapper-td" valign=3D"top" style=3D"border-=
collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans-se=
rif; font-size:15px; color:#525355; word-break:break-word">
            <div id=3D"hs_cos_wrapper_main" class=3D"hs_cos_wrapper hs_cos_=
wrapper_widget hs_cos_wrapper_type_dnd_area" style=3D"color: inherit; font-=
size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" d=
ata-hs-cos-type=3D"dnd_area">  <div id=3D"section-0" class=3D"hse-section h=
se-section-first" style=3D"padding-left:10px; padding-right:10px; padding-t=
op:20px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border hse-border-top" style=
=3D"min-width:280px; max-width:600px; Margin-left:auto; Margin-right:auto; =
border-collapse:collapse; border-spacing:0; border-left:0px solid #008cc1; =
border-right:0px solid #008cc1; box-sizing:border-box; border-top:0px solid=
 #008cc1; background-color:#FFFFFF" bgcolor=3D"#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1;border-top:0px solid #008CC1" cellpadding=3D"0=
" cellspacing=3D"0" role=3D"presentation" class=3D"hse-border hse-border-to=
p" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-0-0" class=3D"hse-column hse-size-12">
  <div id=3D"hs_cos_wrapper_module-0-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP3qgyTW6N1vHY6lZ3lLW8-3bTn3wKf2QW8db=
KYS6tkRHcVFNrwq5w8jfFN1vT-lsGRkP2N8Gn--tYcGzTW8KZpN25dgX1LW40jQ5W63RJ8DW8Gn=
1fd4CwZjkW51DDgp3jNxqjW2FW9Ct4c3bJ-W13CkdV4V3ljdW3FdFvc8Y_r2KVb6CxR5_kCmlW2=
VZSh776WN_FW6lJ_ss5h-DCkMjTdsmG3Gk1W6Lhrgl1Jmwh8M4d2_lPP89QW2RKxbC6-HVDZVF5=
HD56Qx6YpW1lY3Fn3xmk9yW4BL6GC2LG0q7f8JdBtT04" target=3D"_blank" style=3D"co=
lor:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"Wordfence-Logo.png" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/Logos/Wordfence-Logo.png.png?width=3D600&amp;upscale=3Dtrue&amp=
;name=3DWordfence-Logo.png.png" style=3D"outline:none; text-decoration:none=
; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16=
px" width=3D"300" align=3D"middle" srcset=3D"https://email.wordfence.com/hs=
-fs/hubfs/Logos/Wordfence-Logo.png.png?upscale=3Dtrue&amp;width=3D600&amp;u=
pscale=3Dtrue&amp;name=3DWordfence-Logo.png.png 300w, https://email.wordfen=
ce.com/hs-fs/hubfs/Logos/Wordfence-Logo.png.png?upscale=3Dtrue&amp;width=3D=
1200&amp;upscale=3Dtrue&amp;name=3DWordfence-Logo.png.png 600w" sizes=3D"(m=
ax-width: 300px) 100vw, 300px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-1" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-1-0" class=3D"hse-column hse-size-12">
  <div id=3D"hs_cos_wrapper_module-1-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45nR32W7lCGcx6lZ3n-W7V5SdS5FrGS_N9d6=
Jfx-X24pW5qbxYD1RsjR3W6KkdX06Ff9ZDW3vl4yB1vJBPtW6MZNkn3_z7lGW4K75HB8lyTdTW4=
N95Hp7Ch4PWW7fjv3g873Ny8W91BCXg4_GWlJW6d11sN28gShWW7y8PW_91Km-zVd8-F95bj7kH=
W5G_Yj21YhtbcN2NwclphpwLQW4NzGXC3lBjSFW3Kt2LZ6yDcMMW1gjCQ93Vw7CQW10yFKn2sNc=
gkN8rhpHHt05spW3fkb9p1Ym4SQW636X0f7TD8YgVG504G8Yv6JGW2VtTPn5fcsvYW3jpK_86Cr=
xcDW4sRDpN85W573N1DvMW7GxmX7W1SzFPr2LTR-2W7TMWSP78vg_VW6nBj_h5Kr3RFW1n_ZjC5=
90QQQW7HH4Lh4QrdQ0N3Ms4bggdHSnW7J36208HsfY_W4-0Fcw4fTtHNW1DpsKl2hrQXxW77mgY=
y6W_msFW1m937H8v_KqJN5GftFlyyj5fW6LvVDL4TrCp4d8qGkT04" target=3D"_blank" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"FeaturedImage_Wordfence_72.05" src=3D"https://email.wor=
dfence.com/hs-fs/hubfs/FeaturedImage_Wordfence_72.05.png?width=3D1120&amp;u=
pscale=3Dtrue&amp;name=3DFeaturedImage_Wordfence_72.05.png" style=3D"outlin=
e:none; text-decoration:none; -ms-interpolation-mode:bicubic; border:none; =
max-width:100%; font-size:16px" width=3D"560" align=3D"middle" srcset=3D"ht=
tps://email.wordfence.com/hs-fs/hubfs/FeaturedImage_Wordfence_72.05.png?ups=
cale=3Dtrue&amp;width=3D1120&amp;upscale=3Dtrue&amp;name=3DFeaturedImage_Wo=
rdfence_72.05.png 560w, https://email.wordfence.com/hs-fs/hubfs/FeaturedIma=
ge_Wordfence_72.05.png?upscale=3Dtrue&amp;width=3D2240&amp;upscale=3Dtrue&a=
mp;name=3DFeaturedImage_Wordfence_72.05.png 1120w" sizes=3D"(max-width: 560=
px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-2" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-2-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023190359051" class=
=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=
=3D"color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-=
general-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapp=
er_module_17023190359051_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs=
_cos_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; l=
ine-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=
=3D"rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">=
On December 11, 2023, we added an Unauthenticated Stored XSS vulnerability =
in the Popup Builder WordPress plugin to our Wordfence Intelligence Vulnera=
bility Database. This vulnerability, which was originally reported by WPSca=
n, allows an unauthenticated attacker to inject arbitrary JavaScript that w=
ill be executed whenever a user accesses an injected page.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Later on Januar=
y 10th, 2024 we received an interesting malware submission demonstrating ho=
w a Cross-Site Scripting (XSS) vulnerability in single plugin can allow an =
unauthenticated attacker to inject an arbitrary administrative account that=
 can be used to take over a website. This type of vulnerability is often ex=
ploited in order to add spam content or malicious redirects to a compromise=
d website, which we frequently see when performing <a  href=3D"https://emai=
l.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_=
ygN4qMxLn3qgyTW7Y8-PT6lZ3pzW6h6ZH47Xqzv5V83Plv3yJ-PSW5WXfbz7Hv3DyW4vLbxw3ym=
V_NW7n2gD429VHLXW8vC7yz5DbkfpW74jbjm2Cz9_wVytsYV4Vl5LYW6pH9dS1Z45FlW2K33Pv4=
k99QlVHZn9x6H1-3wW4t9Jfg4stp9xW1ffSfB7_mZLJW2g0W2M26LjNGN35BngcX7BrWW8FD5Yz=
7zw3JdW5lck832khQ5sW8LKXrM5H10q0W6pRxm38hxKK3W1r8SLC3X-12GW2tHLsX2w2LQtW49N=
-TJ3b_G5MW4jtcDg1s88V2VV5-Md6Vk-b6W1tWHFr8Bdx_CW2sVF2L5SDVLTf4mCyrF04" styl=
e=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0" tar=
get=3D"_blank">Care and Response</a> site cleanings. However, this time we =
found a successful attempt to directly inject a WordPress administrator acc=
ount, one of the few we've been able to definitively attribute to this tech=
nique with the evidence still preserved.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><a href=3D"http=
s://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5G=
RJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3mFW4bwtMT7ktL8zW22Z3LK58-tqpW1jwhqY3FTcf1W=
8VJ91g3m3H87W6KYckP283pztW3P9Mr5507z0HW7Xtcbz2JwsMMW49TB5x6Yhv8gW1PvfmN1lmX=
_ZW3vvcFR884BsCVY0P8j4RnpLxVT-TWb1CGNXDW5rRsX26fzmyQW6n7WRL4vQKhmW47QJhb79Q=
4p3W6ys-kr4bfqcSW6TD8b_5W7NXPW519tmk6t7v5yW4dKBnt3WZPhgW1vCTdQ6XvWnlW8yyTDc=
4Pq1cRW4Z5JLy2fSMfpW9fjl4r4cFltXW51xYsL56cPQfN5pf7lf--_9mW6Fxdtk8Z_5tQf8-j6=
9204" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-h=
eight-rule:exactly" data-hs-link-id=3D"0">Wordfence Premium</a>,&nbsp;<a hr=
ef=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD=
792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3pRW29S2dW4w3CsYMlcp7wy054BN8glSD=
spTRv4VRv3sc4GQnylVHqwYZ1G-LG5W29qhnQ8sQ0X7W1Vq6Kx7dMN4dV69Xqd8G7XVxW7F9Btt=
9dssBlW7TPprc14CqnTW6R_qtx8fJsr1W73CM7F3Btg7vN4PKqrvRwGFyW7QSGgd62Nj60W262Q=
BV4mztDzW3H7kk195tVmyW7ZD7J23VXLnLW1nsQH48WXQlSW3l6F0p1-nqDwW2xDvKj2GR78zW5=
Q9VHc5wP42KW4bJ31x81Lk_CW8M_fQY99jxYfW4H1SSK129nCnW62nS4P3_pBZwW195Gyc2dM56=
nf1YVNVP04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-=
line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence Care</a>, and&nbs=
p;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9=
-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3kwN3hTjZfnZbXHW2mcfYX7Yw2=
j7W1Jwswr5WQ0sMW8tT2JS8zGPWlW6Pw3vN4DWG3sW8gpLZS22fQT-W34WNj17Fy_4sW24H8JH2=
_8bk0W3mYWSx4FCTlkW3HfT6d4cJlY_W6Knm5f2NQKqCW6rGGB061njD9W12Dc_b5qDHZ0N2kCF=
VbffBZKW5hfSdS1Jt5l0W7dLN9x5gmf9_W5Nt5553PDPs_W1_Sjmm7jtyS2W57dgcS3_1V6wVbT=
gLV6_gbtHW5cTB5942pZrDW4s5b505B_D15W256gXH633YsyW5nfZd98HyKRQW5Ztzm849wKC2W=
43gf151zcTLcf2hpT_Y04" target=3D"_blank" rel=3D"noopener" style=3D"color:#0=
0a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence Respon=
se</a>, along with&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+1=
13/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3mKW=
8ymFYT1nNLxHML5zjQBBl8wW1ckT8B8BYGQxW96K2Yq7h2hPWVrTtgw6lsk9LW6stDKg55DjZTN=
5h3NS6dLMGGW8j5dYM2drsJgW34G7rX1Zpz5DW5jk_jF2zYBjxVhGfNX9ddjjDW5ZxgJy960Z3g=
W5p-V2B5_LxLdW2CQ4gc6rkM2WW3mF---23XtlRW2tfd3_10yPYGW2Q-LP67SvyryW74v7QF61k=
mL0V1fBN41G2NbbW74X4qf8D0BsvW2JYT3t6WNsLfW7C1DbH6ZQ1WTW1Yv4882R7vgGW1R0sZ02=
BPwM6W4V6Lrq10gNm-W4LNBmy3s0LNZf6tChhP04" target=3D"_blank" rel=3D"noopener=
" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"=
0">Wordfence CLI Paid</a>&nbsp;users received a malware signature to detect=
 this malicious file on January 11th, 2024. Wordfence free users will recei=
ve this signature after 30 days on February 11th, 2024. In addition,&nbsp;<=
a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1=
gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3l1VG5_Yq5kMglNN2dCBh42NsfHW4=
VxFHR7l30xXW54nqQ93cV7VnW7kVTB51zmSRPV_G1NL8pLB-QW7Bz-BC1k19NRW4DFwYl6rL1Gf=
W3GDnGt1g7VGjN33LrpMQQttwW7lLkhd2drVgcV6tK0t2qvTkWW2Bb1XL38qFK2W6XFMCn4P46Z=
bW3TSJ8l4dCJF1W3Wb9zD8g5jpTMc_gP9m0RMdW2MHGMf43yyjdVqkfRr5LdBpjMMCTNhnKtxGW=
103XdM6KcndcW9lNZkT1MqLLMW2Xr-Ry8myp20W1F7lnG2W9JFWW16W6LY8hCD_3N6RPQSy6g1J=
3f7VsjfY04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-=
line-height-rule:exactly" data-hs-link-id=3D"1">Wordfence Premium</a>,&nbsp=
;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-=
W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3l0VVFljw3zlDk7W8PrFgn8KlfP=
PN13ty0xwvmNgW6rSjzC3YtHB0W5RYZPj2gL5f7W367lHJ904B03N26gWFsX0QxjW18vQxT4flq=
lYW55Bwrg1-LqNvVqgbzN2q4M7WW8j4nd72dNXyVW7F0-736L34ZgW4WFgGV6FtTH9W2-6kKS6v=
LZ5GW1vjh1t3wHQm1W4Gclj_4k52xmW7rbxYM1xy1bBW3NRgsn86CDzzW6MGrxQ3xN3xvW4cL00=
p5tmwydW3zDG0485cqcSW1bGRgH4Tl1j6N9gwnFhh9gp-VB7zBT6N41_sV2GT8c2Yh8PsW11RB4=
65s8PtZf7bfphP04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd=
; mso-line-height-rule:exactly" data-hs-link-id=3D"1">Wordfence Care</a>, a=
nd&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3mbVZs3ld3pfQb_W1xFd=
hK5x2JN9W4_7B4_1csff5W8RBRTY3VxM9SW1gFN0S5b9F05Vb5gCt5v0cg7W3d__Sw1gCQ5TW5D=
w57D3GLnzBW6H1fMk2VJm7SN3t77TtzCbYqW92lnTm13JHhwW6qP_p88WQc_FW3wRX3173vtJXW=
44n6qP1NzF5sW5M7gzf1kNwtNW31_bGH7cSfT5W77x3PD5sdgSCW4nYKLR6_km-qW4KgVDW3my5=
DCW8M5mSN6khkBHVkc-NY5TvjfcN8s5_CcKJHyZW5gP1kC7hK1xmVQSGGJ8HS7kbTV-BD3RrFq1=
W5C2-G54b3wNhf8KdPgH04" target=3D"_blank" rel=3D"noopener" style=3D"color:#=
00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"1">Wordfence Respo=
nse</a>, along with those still using the free version, are protected again=
st any exploits targeting this vulnerability.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">If you believe =
your site has been compromised as a result of this vulnerability or any oth=
er vulnerability, we offer Incident Response services via<a href=3D"https:/=
/email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1=
L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3p7W4cTvsM5JnVb4W8kBLMj1MgY2vW6lhhRQ2KZwp7W6RH=
vcn6dT651W2C1cqj7Q8qtQW4QfsWl56dbBqW4KJgLK7CWyVFN8YTgYpv24rzW8rSwFy60Tj-WW3=
3g20r8W-g2yW8YFq7v405XfHW6vvH1Q42m68NW82lQW03mBxxTW3mG6W72nZj6nW5928WH7kt0x=
gVFKKZp7Hg19FW184Y4G5CDm2bW9jqzYm3B-2hxVdh3yH1DcyQyW2zZJhw3bpMT_W5VjwLG8_31=
9XW10BrQC2jBtyfW1MMw768HwCY_VzQQbZ7fCg4GW3Kg8NG78x6BcW4cDp4H71LD6_f3NzltY04=
" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-heigh=
t-rule:exactly" data-hs-link-id=3D"2">&nbsp;Wordfence Care</a>. If you need=
 your site cleaned immediately,&nbsp;<a href=3D"https://email.wordfence.com=
/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW=
7Y8-PT6lZ3n8W6d1hhb93F9srW6qD5GB5LQjVLW92nwTl6PsfWYW2JQ4_g6sYZV2W8T4bqw2fM8=
VZV71Hqn1mxfNkVwl0T58yLyfpW4vzMLs8LvflnW8kWsc_1CBmfCW8sHPvb6y_RtlW8rYlMQ2tv=
xF3W1k1dsW7KqTvNVZY2KJ1RCWj7W5G4xJd2GbYRWW6SM-Cd5MdWVkW5N-D5K88vCXpW8dBn5f5=
YsSz2Vp4jRL3B9-pDW306fRV47NsSdW4-t6_h26WXhnN5tbYffkGgSjN16T87NrnXypW3sFQkf9=
2R2tcDJWFcdKxvpW15LtKJ42XX_jW5KLLsn6-cMrYf2p91BP04" target=3D"_blank" rel=
=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs=
-link-id=3D"2">Wordfence Response</a>&nbsp;offers the same service with 24/=
7/365 availability and a 1-hour response time. Both these products include =
hands-on support in case you need further assistance.</p></div></div></td><=
/tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_16971242493161" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module">
 =20
  <table align=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" =
role=3D"presentation" style=3D"border-spacing:0 !important; mso-table-lspac=
e:0pt; mso-table-rspace:0pt; border-collapse:separate!important">
    <tbody><tr>
        <!--[if mso]>
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" valign=3D"=
middle" style=3D"border-radius:8px;cursor:auto;background-color:#00709E;pad=
ding:12px 18px;">
    <![endif]-->
    <!--[if !mso]><!-- -->
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" style=3D"b=
order-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, s=
ans-serif; font-size:15px; color:#525355; word-break:break-word; border-rad=
ius:8px; cursor:auto; background-color:#00709E">
   <!--<![endif]-->
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45nR32W7lCGcx6lZ3pxW9jTQQh84y_xVW5gd=
W_q9lM6fNW8XlSS78x1F6xW74Htn07XzMqfW6YJRxB19MtYwW5_DHFr1N-sR5W5PdBkj3XgH5tW=
7GWyGF5jSPmwV8JjC96l2xm0W7VFsWV5DZs3YW2Jl7Sw3vVPJNW1hj6-913BWRTW2ZkGPv5Ptvb=
jW1_PtTd6FyyPZW28vb6M6s5hTZW1lGwhD63YZTVW1j7JbP6sXdKTW5gMxbw38yTjzVMjf-S2fh=
2jwW7JS7mT2QPHDmVSJQ5z3XY4-BW7fzTs7137-ZGW94g58B69Gv9rW6wPwf12myhbLN7HV-SHv=
r1QWW1kfLBT9g5HxWN9kB6Lq1QnF0W2qtJ5n97gMctW2mNsNQ5PZGXNW1MG39_8gMDJ2W2hwpkC=
531NFgVqRRs23qss0HW2m0VRS82nCWkV88Lck8pwtyGW41d5Kw24yz_WW5JFPXT5S4xmfW9gs18=
x9jdbXYW1LC5hC7JMW5SW45fNPW3q95rMW1qWMWG5L70N-f3GvSN604" target=3D"_blank" =
style=3D"color:#00a4bd; mso-line-height-rule:exactly; font-size:16px; font-=
family:arial, helvetica, sans-serif; Margin:0; text-transform:none; text-de=
coration:none; padding:12px 18px; display:block" data-hs-link-id=3D"1">
          <strong style=3D"color:#ffffff;font-weight:normal;text-decoration=
:none;font-style:normal;">CONTINUE READING ON THE BLOG</strong>
        </a>
      </td>
    </tr>
  </tbody></table>
</div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17055020880131" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17055020880131_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:1=
75%; font-size:22px">Detailing the Attack</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The attack itse=
lf is quite straightforward. Once an attacker has identified a vulnerable w=
ebsite, they use an unauthenticated HTTP request to inject malicious code i=
n the&nbsp;<em>=E2=80=9CCustom JS=E2=80=9D</em>&nbsp;options of the Popup B=
uilder plugin:</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><span style=3D"=
font-family: 'Courier New', Courier, monospace;">curl [...] --data '[...]&a=
mp;sgpb-ShouldOpen=3D[payload]'</span></p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p></div=
></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17055022549369" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45nR32W7lCGcx6lZ3lwW2lvBBn6Vzp1XN4mg=
VkvfN889W6STXDJ5y-kptW2qffG01XWZb_W6f2_lK5rT9wZW2W21Z-7bW9ddW1fjfG66drRqhW8=
rdXG086tY14W2G8Pvx2KBSVkW62t0WC8KKbrMVrnQPG3f4_QQVCs_Xm1RKjvWW8hZl8W7drJhMW=
1bpQXs4w65vcW5MQ3nt4_TXF5W8GrHfK4hjhMQW2N36vs8_tBqBW1cFbsX2920QlW66xq146Bpg=
7jW90n_2V5fhL_cW3dY1fr9kFJ3xW5ffH3_8gBfWNVdf8JB6sj_BBW5yxyw-56zNwfW74J1Zs7Y=
NLhlW7py2nJ8_X0CNW3n7QnQ86tpVbN6Rvx2ptl5T1W3fXdVL1JZ9_tV_5HRs95fPpGVmYyrz2W=
xFdCVD0Yth6nvpm9W18LpCv7j2WZ-V8V7kM7Fv9YzW67y6Bw4xjB73W7y2PLP7b7dJsW77F_p08=
7fCJrW8Ww0WF10w8MXW3RgSll8TZtRXW98jTR79k9tNlf2JGhZb04" target=3D"_blank" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"2">
        <img alt=3D"Screenshot-2024-01-11-alle-20.36.49-1024x259" src=3D"ht=
tps://email.wordfence.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-20.36.49-1=
024x259.png?width=3D1120&amp;upscale=3Dtrue&amp;name=3DScreenshot-2024-01-1=
1-alle-20.36.49-1024x259.png" style=3D"outline:none; text-decoration:none; =
-ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16px=
" width=3D"560" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-f=
s/hubfs/Screenshot-2024-01-11-alle-20.36.49-1024x259.png?upscale=3Dtrue&amp=
;width=3D1120&amp;upscale=3Dtrue&amp;name=3DScreenshot-2024-01-11-alle-20.3=
6.49-1024x259.png 560w, https://email.wordfence.com/hs-fs/hubfs/Screenshot-=
2024-01-11-alle-20.36.49-1024x259.png?upscale=3Dtrue&amp;width=3D2240&amp;u=
pscale=3Dtrue&amp;name=3DScreenshot-2024-01-11-alle-20.36.49-1024x259.png 1=
120w" sizes=3D"(max-width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170550225801910" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170550225801910_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The =
custom JS code option itself is a peculiar =E2=80=93 and quite powerful =E2=
=80=93 feature of the Popup builder plugin, which lets an administrator run=
 arbitrary JavaScript code in order to decide if a popup needs to be shown =
or not. The implementation relies on the JavaScript&nbsp;<em>eval()</em>&nb=
sp;method, meaning that this option field =E2=80=93 injectable with custom =
code by unauthenticated attackers =E2=80=93 will happily run whatever code =
is found each time a user visits the website. Once an attacker is able to e=
xecute arbitrary code with administrative privileges there are no longer li=
mits to the possible actions that can be performed.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">A recent blog p=
ost by Sucuri shows in detail how this vulnerability was used to install a =
rogue plugin titled&nbsp;<em>WP Felody</em>&nbsp;=E2=80=93 we gathered the =
first data about it around the same time (December 14th, 2023) and found it=
 was already detected by one of our malware signatures. In this case we als=
o found evidence of the same technique used to obtain a direct WordPress ad=
ministrative account injection. This is the source code in detail:</p></div=
></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17055022327908" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45nR32W7lCGcx6lZ3pjW3fkTqs93Z3SVW64X=
1V25r5w3WW2Q9q_b7wQjGpW5-LKdK4PH3zzW8pDL_31Lnxt6N8gKsKs-zmYqW11zBxd8btlX-W1=
_DVdd3SjYrtW4WyvWj8S80-4W3Tknvh73dMKbW8WXvD27cz_L2W46TWMs2wm8XLW2qPBJb1x4Qq=
QW6C1LYm2m-PlHW8DjcSM5nZGgpW2kZQWH3jFjRyW7kbFCB3M6rbBN4gSMslDgYFvW26Ctgr8HK=
gc-W3dXzjv4ZnMfnVCPHQs7VcTzDW8ppxBT15dYtFW1SZHYs5VNWHkW8XKsMQ5wy2ndW49M4k27=
tC2WWW1jBxM71r08tPW5xzKP6631-5FW649vYr4NQrsDVBtbV08d_dWXW75bCxS2HkmsZW2wmb1=
K7nxFThW46_v6v4sR5vNW196Sql635LM4W6QPDP17H31sMW4Zt6YV3l9lFBW1QFfD-66QWYCW9c=
6lLD7rt1HTW2KpcGQ8MtXnQW7YLs74904yD5W113rzH3_W7Pjf2bHzMs04" target=3D"_blan=
k" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D=
"3">
        <img alt=3D"Screenshot-2024-01-11-alle-21.51.31" src=3D"https://ema=
il.wordfence.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-21.51.31.png?width=
=3D1120&amp;upscale=3Dtrue&amp;name=3DScreenshot-2024-01-11-alle-21.51.31.p=
ng" style=3D"outline:none; text-decoration:none; -ms-interpolation-mode:bic=
ubic; border:none; max-width:100%; font-size:16px" width=3D"560" align=3D"m=
iddle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/Screenshot-2024-01=
-11-alle-21.51.31.png?upscale=3Dtrue&amp;width=3D1120&amp;upscale=3Dtrue&am=
p;name=3DScreenshot-2024-01-11-alle-21.51.31.png 560w, https://email.wordfe=
nce.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-21.51.31.png?upscale=3Dtrue&=
amp;width=3D2240&amp;upscale=3Dtrue&amp;name=3DScreenshot-2024-01-11-alle-2=
1.51.31.png 1120w" sizes=3D"(max-width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17055022264227" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17055022264227_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">There =
are some interesting insights in this code. Unlike most malware, this sourc=
e code is well structured and quite elegant, absolutely resembling legitima=
te and high-quality code; the use of console debug statements is also quite=
 unusual.</p></div></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17055022077086" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45nR32W7lCGcx6lZ3mqW1B9dZb4BDY33N3zK=
3hQq9JXYW1YY3P-58p0n_N2LGDhZ2lRZWW7fsMSK3NGXMkW14wP9b2qHt72W1Xp8H26JFV3LV3-=
T3D4JgFrbN7X3NRmPj8pBW7YvJ2Y73KyTjW8kSgBJ6gHKrgW4-XpTF28hMLTW8cTbZt3Mnq80Mk=
LRrJY33_5W8rZrLz7qxHGvW3H0hB25Vf4w2VtNDbd8CKFRRW6LpJVW53-1p1W2HLF-Z3wsnLyW2=
m0q-_7-bWh-VX2QpH8ltRZhW7PWlT17KdPVzW1LCrJr928Yh2W3r56vZ6wJwhjW4txJ7635WmsQ=
W72D0fm4j1zZlW8Lqwgn8RryVDW6cTQvZ6L00fZW4x0V5M53mXkvW7fsmHG3JQf78N3f8Qybk67=
7LN3tjLT2g8YNqW1NmjTj8C-GSsVYT7Rn20kf9xN1pnTK4pNTX1N7XbXl7cZtjXVBKKyk4-pVqh=
W98344q1rg4zlVCVsKj6Mm7SkW10VPW45_QTwZdWHK3K04" target=3D"_blank" style=3D"=
color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"4">
        <img alt=3D"Screenshot-2024-01-11-alle-20.40.39" src=3D"https://ema=
il.wordfence.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-20.40.39.png?width=
=3D1120&amp;upscale=3Dtrue&amp;name=3DScreenshot-2024-01-11-alle-20.40.39.p=
ng" style=3D"outline:none; text-decoration:none; -ms-interpolation-mode:bic=
ubic; border:none; max-width:100%; font-size:16px" width=3D"560" align=3D"m=
iddle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/Screenshot-2024-01=
-11-alle-20.40.39.png?upscale=3Dtrue&amp;width=3D1120&amp;upscale=3Dtrue&am=
p;name=3DScreenshot-2024-01-11-alle-20.40.39.png 560w, https://email.wordfe=
nce.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-20.40.39.png?upscale=3Dtrue&=
amp;width=3D2240&amp;upscale=3Dtrue&amp;name=3DScreenshot-2024-01-11-alle-2=
0.40.39.png 1120w" sizes=3D"(max-width: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17055021407635" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17055021407635_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The ac=
tual exploit is contained in the&nbsp;<em>body</em>&nbsp;parameter of the&n=
bsp;<em>fetch</em>&nbsp;method found inside&nbsp;<em>httpPost</em>, which w=
ill be executed whenever a user visits the website. As soon as a logged-in =
user with an administrator role is involved, the script will run an HTTP re=
quest to create a rogue admin account =E2=80=93 identical to a legitimate o=
ne =E2=80=93 and send the new credentials to a website controlled by the at=
tacker.</p></div></div></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17055021376484" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL45nR32W7lCGcx6lZ3pTW2nYB9q5BYXr0W4Rw=
r0Z3CSg71W2lkf1q8_kQrwW17Cmpq4_Q-lcMmpw315ftm2W7zQBNm8G-4V3N8BbP49K6gL0W1cv=
2P27LK9D8N8G6hh-74BpgW1ZJyCL7fvZpXW2bPCwt5x5T8vW410WSf6kMTNpW7sWr9r5WSHJ9W2=
JfyPc8CvQKJW1QXnrj1_LZsGW1Pdrlj6dd3w5W86lz6X60mqZsW4YGWQp5n67JQW3TBB9n1n_yB=
tW3qTLzL1HGkZvVcFys23c37r6W7WT3KZ48p8rJW1pvLZ58Hxy3-W3DyX7J7qNXNGW7KQ1GG3Yt=
7w5W4NdVGx3PxBpRN6LzywV3p3TZW4YxWX75F8zZzW8tFp2W45rW3_W7DN3vM8lgMHFW2DNp-N8=
JYCtVW43z-nX1kzWB3W3Sl5M913W40WW5XSLQ36RBLL_W8cb8x35WGSmGW4CWKjm8NgK-WVzG3n=
h8Hx_ssW2yT0QG7Qr-xqN4TwGv_nqTqbVplCJ26rZbj2f2j7NSq04" target=3D"_blank" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"5">
        <img alt=3D"Screenshot-2024-01-11-alle-19.08.56-e1705325917959" src=
=3D"https://email.wordfence.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-19.0=
8.56-e1705325917959.png?width=3D1120&amp;upscale=3Dtrue&amp;name=3DScreensh=
ot-2024-01-11-alle-19.08.56-e1705325917959.png" style=3D"outline:none; text=
-decoration:none; -ms-interpolation-mode:bicubic; border:none; max-width:10=
0%; font-size:16px" width=3D"560" align=3D"middle" srcset=3D"https://email.=
wordfence.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-19.08.56-e170532591795=
9.png?upscale=3Dtrue&amp;width=3D1120&amp;upscale=3Dtrue&amp;name=3DScreens=
hot-2024-01-11-alle-19.08.56-e1705325917959.png 560w, https://email.wordfen=
ce.com/hs-fs/hubfs/Screenshot-2024-01-11-alle-19.08.56-e1705325917959.png?u=
pscale=3Dtrue&amp;width=3D2240&amp;upscale=3Dtrue&amp;name=3DScreenshot-202=
4-01-11-alle-19.08.56-e1705325917959.png 1120w" sizes=3D"(max-width: 560px)=
 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17055021064632" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17055021064632_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:1=
75%; font-size:22px">Indicators of Compromise</h2>
<ul style=3D"mso-line-height-rule:exactly; line-height:175%">
<li style=3D"mso-line-height-rule:exactly">An administrative user account w=
ith the username wpx or email waterstyle29@gmail[.]com</li>
<li style=3D"mso-line-height-rule:exactly">Presence of wp-felody WordPress =
plugin</li>
</ul>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Timeline</h2>
<ul style=3D"mso-line-height-rule:exactly; line-height:175%">
<li style=3D"mso-line-height-rule:exactly"><strong>December 1st, 2023:</str=
ong> First occurrence of wpemojii[.]com in WTI</li>
<li style=3D"mso-line-height-rule:exactly"><strong>December 7th, 2023:</str=
ong>&nbsp;Popup Builder 4.2.3 released</li>
<li style=3D"mso-line-height-rule:exactly"><strong>December 11th, 2023:</st=
rong>&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VV=
TJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP5nR32W6N1X8z6lZ3lqW1h2Xj18P8SyxV=
YJVHs4dW_pLW7tTjK04hl7LFW97YC6W1kBjpZN8m0JcMl8Y1sW3xJ-5054RhzpVx91wP7nmPK1W=
7ZN4nk2Pq2HwW6y57vH75xknkW4jbmmW7S1JGKW4sDR6t5R_4s1W6xyN9N5spQZ_W7Q60_71CRY=
_tW81WbTQ2bRbqcW8XkrZQ3crt77W8Xr57k2K0K_hN1ZyP7RYbwF8W7sgT_C5vTXrDW8GVlpx8D=
lXMWW4ZC2xM8zcPM3W27_mxK97ZW4mW5Ps2pF9h0sKDW2-GB5j8f1Q4JW6LJRgS3djbTPW5_RVZ=
c6fdK3FW8s3kC-5xlfM3Vs9gRC1VWT_HW3fSRLt95bVXPW472XWp8vKFPkW5JPMm22CgbpLW4NS=
z755fYNP1W4tdBdj80WMGMMn9tjLSDW80W8m0ykw7B3vcTW3J1Sqz53tcTWW3m9lh081cMFFN1q=
qkkhwt3zxW6mSqsH7G1SvXf4JR5DK04" target=3D"_blank" rel=3D"noopener" style=
=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">Vuln=
erability in Popup Builder Disclosed</a></li>
<li style=3D"mso-line-height-rule:exactly"><strong>January 1st, 2024:</stro=
ng>&nbsp;Exploit&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113=
/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLH3qgyTW8wLKSR6lZ3pNW5k=
F8Xs2QkZr1W3-_03l2t5ptPN5fd6XBXjwJTW23tWq_3-BWvzW74dFD02_d30tW1HPJm44bQmk7W=
6jpbCz4YXybmVsw2C_57dX-0W8T354X8PVPYHW9hbF771lytRHW7x9q3K5Yr8kLW71gphz3B0ty=
CW1PVndn28hSxwW8zlh7q3-fF9HW6nw5mp4d_z7JW1gMtWQ5dtFMGW7jGGYD2HmWBGW2prLbq7F=
csBpW70MbYs1m81dSVMbMX37rWZgBW3kt3TK2CSYrlN5nD6wQjKJLHW43p9Lq8swdYmW5zQc803=
cNC_CW2dtdsQ6xGFhlW96T9yd2VhRwrN6B131hWswvzW7yjBKs6VMcktf6YYx0004" style=3D=
"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0" target=
=3D"_blank">Proof of Concept</a>&nbsp;released on WPScan</li>
<li style=3D"mso-line-height-rule:exactly"><strong>January 9th, 2024:</stro=
ng>&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJ=
bg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLH3qgyTW8wLKSR6lZ3kQW2rg6FY5k6BwsW3c=
s0Hn6zTsszW5JTRVc3HNgV3W3N5Y7B1dBzz4W7wwm5P8x6W2vW5ljg0D5t3qvDW2Xkh3v1ZS-hS=
W1bwHqr3_Y2hTN1wt1_7w6jV8W73mKcR2nkb0VW4BjqbM3jVl2bW1DTFk81ctXqGVDb02b5Lmtl=
DW6WnfMm6lhml5W9d5gLv6cBdCPW14QVLc5v4WKZN6ZY27zl9jX5W5F7M4s27yZxYW5TjK2k7tz=
6-qW5G0rs12QxD0CW3dV31f29tMWPW5KNy8c656_cDW5-y4794CBjqqW11zBD181cSM4W5lCCZn=
3gXtYJW7R-NPg6-vSRqW45-9fT2hWQ22W4pB5QP15r2Zwf8q2nvH04" style=3D"color:#00a=
4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0" target=3D"_blank">=
Forum post</a> referencing =E2=80=98a virus=E2=80=99 on wordpress[.]org</li=
>
<li style=3D"mso-line-height-rule:exactly"><strong>January 10th, 2024:</str=
ong>&nbsp;Source code used in the injection shared to us. Malware signature=
 developed to provide detection and protection from any attackers trying to=
 inject this malware.</li>
<li style=3D"mso-line-height-rule:exactly"><strong>January 11th, 2024:</str=
ong>&nbsp;Malware signature pushed to production after testing.&nbsp;<a hre=
f=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD7=
92Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3mvVGXmMd5Q-hlQVXXlPC65tZtYN69Vg8B=
jDDtzMXDMCF7nZ4YW8HcF035PZMCMW7pYj1p3cLXCXW8rBx_27HwwdpVdw2dT6rrQmtW1vfhy91=
YXg_CW6Pfw8Z14NQqwW1HPsG32GpRb3W2cw0Vq7jMm9zW7xNK0m8x6nvrW4YdW4D7qGPMZW889X=
W77stm01W1nhR6L7qgrc5W6kmrPK8-VlrdN6fLz4z4J7ssW8NGTTz4sCd5jW9jdmjD5QnyLkW6T=
NpLk7sTJR9W4f_kxY41nGpWVnQDC02qTM9DW7yqtCn9dqq2cW1kWT3B1qZkY6W8Bjyv61x1PrTf=
7kzhSK04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-li=
ne-height-rule:exactly" data-hs-link-id=3D"2">Wordfence Premium</a>,&nbsp;<=
a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1=
gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3nwN8h_hmF49H7TW1-xSrN2wqtkmV=
W5srz4q8HkvW5RCjXS49_LmjW1ZCZ1S55GF8lW3ZkPh57pSZVqW4T1BbW2NR_2HW4TY_d944y_s=
1VSn94m4WCrHNV-yZWc4mxkJYVC1FBH3C8mTPW7sJm776K9b4vW2DNv7c4xHgR_W5nCYH18cqsb=
6VVvMTT5DP8cXW5T2Bvz5TnBN4W8qGvmd5N-G0DW4jhGWS3KBvVwW2wp0Cr8vKnlLW2fQm-j3r4=
GKMW4MHrTv4CdXt7W40b5Zq6zsxdBW82WzBM9bc4KcW3DQDbr3HzJ3sW1q1lbX3KJCnvW3nQM4s=
3_kBKcdltQNq04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; =
mso-line-height-rule:exactly" data-hs-link-id=3D"3">Wordfence Care</a>, and=
&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2=
MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3nZW5cLcnv3bws27W1yDRm=
56JC3fFVjBBmw1tPQb0W8DsqHT2B-Pm5W1fQhR96GSVKrW3yGvJx1-6L8GW6xpYVd8mtlXhN1qh=
0mRsgxXbVx9pzJ7nKRrQW1S-Q-G1XDwcxM5gbYNBLPHzN5GXgHb4_T03W2tNlVW3vlXHQW2SnXh=
x74RjzzW7p2c1q5cTgJ4W3Dn0rH5f3mM9W5WwP8V7rz5tdN6K7pKr5ZS5QW1RRXxy3l1WyWW8D5=
yqX97YKG1W6m9-HD66WwsWN7yb0LdRHqr5W8lwPtr79kwMWW4YbsKh4TVH85W4bg0QV6mnCzkN3=
_sgRdRjV4-f4MG0qn04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a=
4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"3">Wordfence Response=
</a>&nbsp;customers, along with&nbsp;<a   href=3D"https://email.wordfence.c=
om/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgy=
TW7Y8-PT6lZ3lXW5R_QVY6Nk9b3W5LJsJb3rqnRPVFLG577BRgmJW2RW-7G3rFDGMW6dZrBJ4R2=
wbVN2C1-PWMfbpRW7dk5p84mY7VcVq4k1N1jmR71N6Sdfv6KVPk3W5RR4Ym3VmNyzW1mTLjB5cs=
vBnW59ZKwH6lpqzpW8XWTZr808mV7W1xLWsS4Fvl1lW3dTwr86S_W9-W2cFzfx2BXtsgW6CVjGQ=
7nWfWvMnGr9D_PktGV4PzBX5ylywqN11xjB12B7P7W3MBNvf5VpXY4W2w-G1g5GsQbyW105t6C1=
LMWkwW5M__-54CskwJW5Z6GHt7v8y9NW1WSLmn6vhy8Qf5f3N0404" target=3D"_blank" re=
l=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-h=
s-link-id=3D"1">Wordfence CLI Paid</a>&nbsp;users, receive malware signatur=
e.</li>
<li style=3D"mso-line-height-rule:exactly"><strong>February 11th, 2024:</st=
rong>&nbsp;Wordfence free users receive malware signature.</li>
</ul>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Conclusion</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">In this blog po=
st we detailed an unusual direct WordPress administrative account injection=
 method based on a Unauthenticated Cross-Site Scripting vulnerability expos=
ed by the Popup Builder plugin affecting versions 4.2.2 and earlier. This m=
ethod allows unauthenticated threat actors to add a rogue WordPress admin a=
ccount, resulting in a full website takeover. The vulnerability appears to =
be addressed in version 4.2.3 of the plugin.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">As a reminder,&=
nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2M=
QD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3pjW4q2KXn4HGwF3W8XL4jM=
7ZxhFpW8ny2X43HPc63W3YrtvJ5km3PmW3SNKzY6pXQxnV8Nkdt3MBnQTW2DBr602XWs6wW1Rwj=
J24XW644W5jtvds7z5n5_N4HLjWpXfX6MW3bG1WW8l-PszW4Z5Q157Szvd0W95BbDh1-HXDqW5B=
8ng14XXfGDW5Tf90n8Pb73vVTvXkQ3hJfMzW2S1VyS9lc_sMW8-ynvM9jzCCZW33cq_D77Q1ZKW=
1DcWxt5-xv1kW7zgsct3Dc4Q1W2sKmRQ12-WjkW16sn4H813Kd_W6_NgS01YlbyXW7H2bRg9f1K=
sjW4h5BQH3HpVtYf5WQbbn04" target=3D"_blank" rel=3D"noopener" style=3D"color=
:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"3">Wordfence Pre=
mium</a>,&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R0=
4/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3ngN8_nGCGyL9=
RjW3z84xd7jjRGHW4gMNX_7BqB9WW7gzKQF8SFrzbW6WJrLS7qt83PW256-jv7bRrfLW8H97GH5=
lwx7BW1lmKHt1pmTfXW8yTL-77LJdvNW1N5fS55SfNfMW1P93GX8WGQH_W1Z1xSF6CHBRNW8FV4=
cl7bf8tvW69YtBP5LxLZHW90lRGp6GCzHQW40YBvq372R5HW8q7fvr6SS4CyW6txRCs6DbYKqW7=
GsPSt2YptzTW5-kwNm7PWGj0W8P45y17c59VBW5Z_F872d1W4yW7FbkQF2RQ8ZtW4qV9Qh6WZ2Z=
hW7SqTWw87WcNsW3rmldg53v523f8ZXXml04" target=3D"_blank" rel=3D"noopener" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"4">W=
ordfence Care</a>, and&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/=
GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ=
3mDW7jnRB741R2v4N6NqmDCCPW-YW1XHnqy4RC1NTW5xMcm19gf06wW73lR0R36wSjVW4Xk7dd6=
TNT6rW5kqYt28WM88kW33kVKj64y1v-W88vkd_462S_0W75jtZH1Q8QH-W5T_RWg1RQc83W1yMg=
FD6MLsVCN50_RWVkk24fW5ZV8VB2TcGznN7L6XY329t2zW7qj8v066HL3DW5Tgx1b2wvH3vW3b2=
Cv-8Jh7GqW6FCl1r6tLb9JW8vV3bN8SBFJ1V3C8xJ8vv66mW7rgL_15jmYRkVzDyBS7-HS4NW5q=
X9jk2JHbd8W5nhMT13g3pDyW63rkCn3vbYqRf6P4ctT04" target=3D"_blank" rel=3D"noo=
pener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-i=
d=3D"4">Wordfence Response</a>, along with&nbsp;<a href=3D"https://email.wo=
rdfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4=
qMxLn3qgyTW7Y8-PT6lZ3lZVWxMdr89V40-W4_3rgR6fB9k4N8mVtMMFzTfxW1gyd7r60sZnDW8=
znWYc3mgp9_W9gS_sH2HqT8hW3C9mCd5wkWP9W6Dm28553Xn1RW4GCgsQ3WfNB1W91S5jd6Hs7T=
BW1SNTKg9hLrPPN2MrllnwQ8SxW7FpXXY3JmS4LW2g7qyZ4CnFn2W7z_YfB7rWLF_W3HPmN43NG=
s53W6WkYN580B87kW93HkQH62tNltW5hTCf777WkhxW8WCwLC8wVYkxW4Pk9Jf3wjKkLW8ts5qp=
6Gy7gXW16dbc05w8f0qW2SNp0J3s5CLvW1175kY2yQ3g-W7kq94c30pQ0-f755ljW04" target=
=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:e=
xactly" data-hs-link-id=3D"2">Wordfence CLI Paid</a>&nbsp;users received a =
malware signature to detect this malicious file on January 11th, 2024. Word=
fence free users will receive this signature after 30 days on February 11th=
, 2024. In addition,&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC=
+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3m=
KW3gDGjq8hrzJVW3PDbyv1HXfvQW3LKQxk5W1yYVW6NsTQ_8pbxTrW7ZyNJS4Zts7jW83CP2W4p=
78p1VGkdL51jfh9WW816byv2YzM9xW7pckNb6JbX1rVk0s7C1240qnW8nlV_c7VyMWdW3_4kF35=
XrPnnVjsG8x74NxWJW67YtZB71gkvMW1LbCmt1Z1fkPW1wbqzw4SbpmXW8W5ZnG1SRV6HW25bj2=
k142n6mW7bbDfj2Ff-HYW481gWC5_FsDCW5Vs--K1QS7cBVQr3DW97YJq1W7MVlSB7JKYgnW4KZ=
BB36T1hwQW898ztd227wghW3X82Vf3Lvt72f3jmX9g04" target=3D"_blank" rel=3D"noop=
ener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=
=3D"4">Wordfence Premium</a>,&nbsp;<a href=3D"https://email.wordfence.com/e=
3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y=
8-PT6lZ3llW4k_TZ22qs70sW1GFTs_5xs6ZZW4F_bTs3xXzc_N6sdF6n-vR9HN6d8hCbZR1MWW1=
FywHY52-tTbN89CsRZT_pvcW3hZ8RW8TvKmJVRmYnt2TpfQwW47zq0R68YmsmW4cJqR55bMhWjW=
15zshR77qc-hW976Gwf3RdRQHF25wFxzMTmsW62phFc7NwT7zW7Z_QWv1lG5JCW8ZnFKW7gFNB-=
W6-Gdj23Z0KczW5cVk-47NCZ0yW336Z4b4XRsBZW6q-SL-6L0SSjW3nTwC052JBKSV6pt1D5B6j=
jvN1zgwxFNPQ_8W7Qyp955TCGHFW3tYYgd4nN4WNf8WX_kz04" target=3D"_blank" rel=3D=
"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-li=
nk-id=3D"5">Wordfence Care</a>, and&nbsp;<a  href=3D"https://email.wordfenc=
e.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3=
qgyTW7Y8-PT6lZ3pGW6gdrH_4vMHgBW8bnnVW489dRBW8vsm3h1NWPf2VHN2mk4_t4KnW1ZHHPp=
5vtdlrW5yLnP43mlcmJN40VcBqddRzgW8R8d504LwP7VW5BbHs15SKMG7W2tFCYS5CW8vDW4zDR=
d_7d0HZhW4qTMb03Q0X1xW35r_ct2HFP2xW37jjY75fDZz3W7xWsLv2zKd5YW4Qfh9X5z3Zc2W3=
dQnVT9kBjZ-W5BQc0B2668JhW2bcHW2563bWnW1-lGDt6d6RnHN4z-yYshVgkxW7jJGcq32__j_=
V591m_87p_yBW5LDSWm5whLNJW7NB5xQ72pgKwN99ZPnQWztBSf3bn7kg04" target=3D"_bla=
nk" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" =
data-hs-link-id=3D"5">Wordfence Response</a>, along with those still using =
the free version, are protected against any exploits targeting this vulnera=
bility.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">This is signifi=
cantly more sophisticated than previous scripts we=E2=80=99ve seen making u=
se of this method, which typically make blind attempts to create administra=
tor accounts when any logged-in user loads the script, regardless of their =
role.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">In the cases we=
 were able to find, the attacker=E2=80=99s domain was always&nbsp;<em>wpemo=
jii[.]com</em>, which was added to our Threat Intelligence malicious domain=
s database as of 12/1/2023 after unrelated findings. We found the first kno=
wn mention of the current issue in a WordPress.org Support forum topic whic=
h suggests at least one other user was aware of the related intrusion befor=
e 1/9/24; this is indeed compatible with an active exploitation campaign go=
ing on since early December 2023. The Popup Builder plugin has had 7 releas=
es over the last 3 months, 5 of which were security-related.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">If you believe =
your site has been compromised as a result of this vulnerability or any oth=
er vulnerability, we offer Incident Response services via<a href=3D"https:/=
/email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1=
L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3m1W2599hM8_sDrhW8tsn-q8Bj2-yN4t95ThPXmYQW3Jtt=
5f25G0F-W86Gt2G3QrM3KW5N0NmC7kt5kwW85fxBV6Yq0g4W6z0j356j8y-mW1s9syS3Qq_ySN9=
7VRLJ3QwkTW4gcynC6R88prW5pQbG22Pyp_PW5t4gMV86LwqFW3VFYFx1K6BGCW1ghjph2P5SwW=
V1X9-x1bF3GLW2wXdxY5n0MKmW7lKVb_7nKhjqVwCC6g6st1QSW4W920h9fp038VlL6TQ1gVWFT=
W2NqwVS2fB9HJN19wKnRb70KBW26k6rX3N7jl4W90dyt71s7czcW4LddLs43Hz3PdvxDwP04" t=
arget=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-r=
ule:exactly" data-hs-link-id=3D"6">&nbsp;Wordfence Care</a>. If you need yo=
ur site cleaned immediately,&nbsp;<a href=3D"https://email.wordfence.com/e3=
t/Ctc/GC+113/cwG7R04/VVTJbg2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8=
-PT6lZ3n7W1R1pp52zbqPhN8H2rtn4PHZhW4QsRST8yX8XKW35MjyP5NJ0HdW6b3pLz898t-XVL=
Rrct1SsDCfW431sB23fTnmMW8Mw5MJ75vkTfW4wPVbv67wXfhW6Wq7FL7h-QW0W1t1d4N2K_6Yk=
W1dYr7y46qwJkW4m6B8L7hG2BtW3r_ZBr4BJ7VJW3lGc2w8MKpj0W2yHPqY75kl2hW1W7_Nq1BM=
1vjW7d3mzH1pxDHZW2b0p3f3zvHFbW7yk3gN882RvsW7P0H5v1XwXZpW4vb1Rn1wwFzHW1Tfbj7=
5Dl4RjW8hM32B9kL74hW88YXFc6ZGQSFN3T3c6vpCTldf26478n04" target=3D"_blank" re=
l=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-h=
s-link-id=3D"6">Wordfence Response</a>&nbsp;offers the same service with 24=
/7/365 availability and a 1-hour response time. Both these products include=
 hands-on support in case you need further assistance.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><em>Special tha=
nks to Roberto Garaffa / 19[.]coop who reported the code injection sample t=
o us.</em></p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17055021147953" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><!--[if gte mso 9]>
<div style=3D"line-height: 0; font-size: 0px">
  <v:rect xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"true" stroke=3D=
"false" style=3D"width:560px; height:2pt;" fillcolor=3D"none">
    <v:fill type=3D"tile"/>
    <v:textbox inset=3D"0,0,0,0">
      <div>
<![endif]-->
<table role=3D"presentation" width=3D"100%" align=3D"center" border=3D"0" s=
tyle=3D"position:relative; top:-1px; min-width:20px; width:100%; max-width:=
100%; border-spacing:0; mso-table-lspace:0pt; mso-table-rspace:0pt; border-=
collapse:collapse; font-size:1px">
  <tbody><tr>
    <td width=3D"auto" style=3D"border-collapse:collapse; mso-line-height-r=
ule:exactly; font-family:Arial, sans-serif; font-size:15px; color:#525355; =
word-break:break-word; line-height:0"><!--[if mso 16]>&nbsp;<![endif]--></t=
d>
    <td width=3D"50%" valign=3D"middle" style=3D"border-collapse:collapse; =
mso-line-height-rule:exactly; font-family:Arial, sans-serif; font-size:15px=
; color:#525355; word-break:break-word; line-height:0; border:transparent; =
border-bottom:1px solid #000000; mso-border-bottom-alt:2pt solid #000000; b=
order-bottom-width:1px"><!--[if mso 16]>&nbsp;<![endif]--></td>
    <td width=3D"auto" style=3D"border-collapse:collapse; mso-line-height-r=
ule:exactly; font-family:Arial, sans-serif; font-size:15px; color:#525355; =
word-break:break-word; line-height:0"><!--[if mso 16]>&nbsp;<![endif]--></t=
d>
    </tr>
</tbody></table>
<!--[if gte mso 9]>
      </div>
    </v:textbox>
  </v:rect>
</div>
<![endif]--></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-3" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-3-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:0px 20px 15px"><div id=3D"hs_cos_wrapper_module-3-0-0" class=3D"hs_=
cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"colo=
r: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-=
type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_modul=
e-3-0-0_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type=
_rich_text" style=3D"color: inherit; font-size: inherit; line-height: inher=
it;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><h2=
 style=3D"margin:0; mso-line-height-rule:exactly; font-size:20px; line-heig=
ht:175%; text-align:center; font-weight:bold" align=3D"center"><span style=
=3D"font-family: Arial, sans-serif; color: #000000;">The Full Product Lineu=
p</span></h2></div></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-4" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-0" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3ldW7lT_Xl1Mpc5ZW90d=
-CS8wl3FWW57lSK-2z34FfN1kZlld-NqRPMCLVQC6VJ8-W41CZS758GKTjVwYxND6Kxb2qW1Pwj=
538T_h0LW16Cwff2wqBhlN1VbV4nbRVkcW5hfdRN6GkD2PW8lq2st8Rvz1ZW1LXz9y1TKBH8N6N=
8hTQWXFGfW8phgYR11M38-N5F2Ppmk8-KKW3Rdl8s3Nmym0W5M79fY8YLtNgW50Q4MJ5L2xGtW8=
9qpl25CvC6LW53d_X71f1nfrN2srwLk9rvC_W5j4WPl5Ph0qQW95tm2D3fjR0GW29lHKL4yNbdQ=
W711q4h8Lyf-VdxMgK404" target=3D"_blank" style=3D"color:#00a4bd; mso-line-h=
eight-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-free-1" src=3D"https://email.wordfence.com/h=
s-fs/hubfs/wf-stacked-free-1.jpg?width=3D200&amp;upscale=3Dtrue&amp;name=3D=
wf-stacked-free-1.jpg" style=3D"outline:none; text-decoration:none; -ms-int=
erpolation-mode:bicubic; border:none; max-width:100%; font-size:16px" width=
=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs=
/wf-stacked-free-1.jpg?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&am=
p;name=3Dwf-stacked-free-1.jpg 100w, https://email.wordfence.com/hs-fs/hubf=
s/wf-stacked-free-1.jpg?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&a=
mp;name=3Dwf-stacked-free-1.jpg 200w" sizes=3D"(max-width: 100px) 100vw, 10=
0px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3p8W5BPcz775DTrFW2fZ=
HPC1yy793N8RmP5yHB4RhVts7mq7sTvl5W864_dK5_N_nzN8jq-ggGP1znW4hbqhy2H6-LRW4sD=
6Jr6y_NKnW92pHS7306wlQW7wLfWv7bCm3MVtNdtv6xjwwLW4KpSYC575J1qW3h3SwM2P1R3wW6=
4pY7c98l45sW4M3kM39cLf_MW8GByS48N-xvcW7f8CfN4ChdZhW5CpjPG70C_0_TlMYl4llDB1W=
8f_wjn3RddpVW4Vx6Mf4j9spRW4yQ3xx7JmvJdW4_GrF98nl476W4vynhm6BWwDdW2Vfwyh1_y1=
ryV6CKxd61XqHqf68D_M404" target=3D"_blank" style=3D"color:#00a4bd; mso-line=
-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-premium-1" src=3D"https://email.wordfence.co=
m/hs-fs/hubfs/wf-stacked-premium-1.jpg?width=3D200&amp;upscale=3Dtrue&amp;n=
ame=3Dwf-stacked-premium-1.jpg" style=3D"outline:none; text-decoration:none=
; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16=
px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs=
-fs/hubfs/wf-stacked-premium-1.jpg?upscale=3Dtrue&amp;width=3D200&amp;upsca=
le=3Dtrue&amp;name=3Dwf-stacked-premium-1.jpg 100w, https://email.wordfence=
.com/hs-fs/hubfs/wf-stacked-premium-1.jpg?upscale=3Dtrue&amp;width=3D400&am=
p;upscale=3Dtrue&amp;name=3Dwf-stacked-premium-1.jpg 200w" sizes=3D"(max-wi=
dth: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-2" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-2-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3pHW459Mlq1Hl8YwW98N=
H0X865Qx4W7Y4SKC9lCnjvW6TSnYX3y9skVW7kXtY246X9WHW6TyBch7QQlYvW7Wqjf86d8y7xW=
1Qdb9V3Ynl5dW36C20h5mSKFcW4L4tCW34JBF5MF4qbt3M6M7W349yRV4JKW_WW3ngNT-3KDBH6=
W2-cC9y1kcxLzW69TRTk7ZqqWfW4njhjT3pQxTCW1S-pQF5QL4c6W6rPbZB4g6m6bVhLcCn4n7d=
z4W1ld0C14-bdYDW69Vtd03rQWLdW99-_0k96v2N2VZYwG292z8WTW4-24tv7rwRVrN18JmqGH0=
XtBN1vwx4l3XmfRf13QkkT04" target=3D"_blank" style=3D"color:#00a4bd; mso-lin=
e-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-care-3" src=3D"https://email.wordfence.com/h=
s-fs/hubfs/wf-stacked-care-3.jpg?width=3D200&amp;upscale=3Dtrue&amp;name=3D=
wf-stacked-care-3.jpg" style=3D"outline:none; text-decoration:none; -ms-int=
erpolation-mode:bicubic; border:none; max-width:100%; font-size:16px" width=
=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs=
/wf-stacked-care-3.jpg?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&am=
p;name=3Dwf-stacked-care-3.jpg 100w, https://email.wordfence.com/hs-fs/hubf=
s/wf-stacked-care-3.jpg?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&a=
mp;name=3Dwf-stacked-care-3.jpg 200w" sizes=3D"(max-width: 100px) 100vw, 10=
0px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-5" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-0" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3mKW2SvJ7M5VppGPW53t=
D6449wx0GW15q9q74HKwW0W1zVqmN116-xmW4mNXZc2h4tq_W24qzyf8s2JkQW5CHB4_3lXLTcW=
2MgxrL2yQHqFN2WQrxyyywJDW7q_nl84CQLKCW7fGhJh8KtYHMN6HvV17WjKYMN4-Hy0CqPnbvW=
1BS4K658n1w_W2mWsy62NL9r4W4dQ0R88_Fm_DV_87Cy2lTPXhVRzGjz4hYVzYW3h6wtN4qyQ3L=
W4GJBXl3jbHD2W55YDNY3_qf15W1zLdjX5m20jVF8_ZVbfhYYqW2slNnL69b_jJW3vCFN36W_v3=
FW7KyG5-6DRdQjf69rWFx04" target=3D"_blank" style=3D"color:#00a4bd; mso-line=
-height-rule:exactly" data-hs-link-id=3D"7">
        <img alt=3D"wf-stacked-response-2" src=3D"https://email.wordfence.c=
om/hs-fs/hubfs/wf-stacked-response-2.jpg?width=3D200&amp;upscale=3Dtrue&amp=
;name=3Dwf-stacked-response-2.jpg" style=3D"outline:none; text-decoration:n=
one; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size=
:16px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com=
/hs-fs/hubfs/wf-stacked-response-2.jpg?upscale=3Dtrue&amp;width=3D200&amp;u=
pscale=3Dtrue&amp;name=3Dwf-stacked-response-2.jpg 100w, https://email.word=
fence.com/hs-fs/hubfs/wf-stacked-response-2.jpg?upscale=3Dtrue&amp;width=3D=
400&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-response-2.jpg 200w" sizes=3D"=
(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxLn3qgyTW7Y8-PT6lZ3lzW5-5zfR8_dvn0W5D6=
6MW4KdlzkN5PGsn61tnywW1PvbW82P17B3W9dqYBK4GmLGzVlxSBC7R0zTVN47mfZbcDHskW2m3=
T7G35lp64W5YQ8RQ1_wZ3vW7hVd9c4m-W2kW6t6Mb681xN5KW264z4t32VBXnW15Bqrb3Ms9JZW=
7Mphr48m2TWxVPGtZq2x1X42V2BD2S4R8dvfW4G_HCh4wgzhNW7vs44596xcRHVx19m52f614FW=
6-lB9n2ljKzTN7N53znx7GVPW2z2rLs2kf8Q3W73TPPp8QL2_mW7PlhSC2zy6x7N1ZjyzQwmzXS=
N5lDfJktryKCf3DVp5K04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-h=
eight-rule:exactly" data-hs-link-id=3D"3">
        <img alt=3D"wf-stacked-cli" src=3D"https://email.wordfence.com/hs-f=
s/hubfs/wf-stacked-cli.png?width=3D200&amp;upscale=3Dtrue&amp;name=3Dwf-sta=
cked-cli.png" style=3D"outline:none; text-decoration:none; -ms-interpolatio=
n-mode:bicubic; border:none; max-width:100%; font-size:16px" width=3D"100" =
align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/wf-stack=
ed-cli.png?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&amp;name=3Dwf-=
stacked-cli.png 100w, https://email.wordfence.com/hs-fs/hubfs/wf-stacked-cl=
i.png?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dwf-stack=
ed-cli.png 200w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-2" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-2-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL43qgyTW7lCdLW6lZ3mFW795gKg849dlNW56d=
7p750qy2lW1C5sz46NzK6cW6YWlQC7RlGsnW8TH2vG6cD2XRW4pbMg57BCn5-MgsMkHfXVs_W3y=
Rj1N7V6qfYN809PMfrDX7DW7TxnFX71_kjgW8dlwxq66WmQQW6_7Xj-7TnttQW5TBNnK3Gq-Z6W=
6dYyjs6RsNL3N2BwWWzzztc_W8t7Gkc1C2fvzV1-4DG3-pFrkW3d8-606Z7024W7HVblY8w-7Tg=
W1wm8bL8DrwtvW59xgBk68-hF6W1dT-0g3yy4f2W3GgXDT4lQYYRW1yxnhm7qV6rZdLn1FC04" =
target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" dat=
a-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-intelligence" src=3D"https://email.wordfence=
.com/hs-fs/hubfs/wf-stacked-intelligence.png?width=3D200&amp;upscale=3Dtrue=
&amp;name=3Dwf-stacked-intelligence.png" style=3D"outline:none; text-decora=
tion:none; -ms-interpolation-mode:bicubic; border:none; max-width:100%; fon=
t-size:16px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfen=
ce.com/hs-fs/hubfs/wf-stacked-intelligence.png?upscale=3Dtrue&amp;width=3D2=
00&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-intelligence.png 100w, https://=
email.wordfence.com/hs-fs/hubfs/wf-stacked-intelligence.png?upscale=3Dtrue&=
amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-intelligence.png 2=
00w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-6" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-6-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module-6-0-0" class=3D"hs_cos_=
wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: i=
nherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><!--[if gte mso 9]>
<div style=3D"line-height: 0; font-size: 0px">
  <v:rect xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"true" stroke=3D=
"false" style=3D"width:560px; height:2pt;" fillcolor=3D"none">
    <v:fill type=3D"tile"/>
    <v:textbox inset=3D"0,0,0,0">
      <div>
<![endif]-->
<table role=3D"presentation" width=3D"100%" align=3D"center" border=3D"0" s=
tyle=3D"position:relative; top:-1px; min-width:20px; width:100%; max-width:=
100%; border-spacing:0; mso-table-lspace:0pt; mso-table-rspace:0pt; border-=
collapse:collapse; font-size:1px">
  <tbody><tr><td width=3D"100%" valign=3D"middle" style=3D"border-collapse:=
collapse; mso-line-height-rule:exactly; font-family:Arial, sans-serif; font=
-size:15px; color:#525355; word-break:break-word; line-height:0; border:tra=
nsparent; border-bottom:2px solid #EEEEEE; mso-border-bottom-alt:2pt solid =
#EEEEEE; border-bottom-width:2px"><!--[if mso 16]>&nbsp;<![endif]--></td></=
tr>
</tbody></table>
<!--[if gte mso 9]>
      </div>
    </v:textbox>
  </v:rect>
</div>
<![endif]--></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-7" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:400px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"400" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:400px">
<![endif]-->
<div id=3D"column-7-0" class=3D"hse-column hse-size-8">
  <div id=3D"hs_cos_wrapper_module-7-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"left" valign=3D"top" style=3D"border=
-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans-s=
erif; color:#525355; word-break:break-word; text-align:left; padding:20px 2=
0px 0px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxKP3qgyTW6N1vHY6lZ3pyW91qfjM1rjqpPW1cs=
kZb23HbqGW9jB56w11zkHbN2Xw7JtMnRMLW23m-P85RZBW-W3Jv48y2ytXt_W1rc7hV1vXf3RW4=
5DMxj5RGZSQW92PTks7_nf54W5XXghJ7Zn_ncW5dyd7P4F_b68VbStGz5WsfJ3W6CdM2D2WKnDC=
V-y8y020bX0cW3JFXTQ1vxl4NW34Vqz11rZjLrW1V2lSR3Mj2_5W7QRhqK7ZW8JMVPml182Z7gw=
yW1Hr_6Q4Rz82wN12Vp_YthpVXW5sKbPB6rq_HndRzGHR04" target=3D"_blank" style=3D=
"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"logo-defiant" src=3D"https://email.wordfence.com/hs-fs/=
hubfs/logo-defiant.png?width=3D200&amp;upscale=3Dtrue&amp;name=3Dlogo-defia=
nt.png" style=3D"outline:none; text-decoration:none; -ms-interpolation-mode=
:bicubic; border:none; max-width:100%; font-size:16px" width=3D"100" align=
=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/logo-defiant.=
png?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&amp;name=3Dlogo-defia=
nt.png 100w, https://email.wordfence.com/hs-fs/hubfs/logo-defiant.png?upsca=
le=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dlogo-defiant.png 20=
0w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<div id=3D"hs_cos_wrapper_module-7-0-1" class=3D"hs_cos_wrapper hs_cos_wrap=
per_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size: =
inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs=
-cos-type=3D"module"><table role=3D"presentation" class=3D"hse-footer hse-s=
econdary" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"borde=
r-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso=
-table-rspace:0pt; font-family:Arial, sans-serif; font-size:12px; line-heig=
ht:135%; color:#23496d; margin-bottom:0; padding:0">
  <tbody>
    <tr>
      <td align=3D"left" valign=3D"top" style=3D"border-collapse:collapse; =
mso-line-height-rule:exactly; font-family:Arial, sans-serif; font-size:15px=
; color:#525355; word-break:break-word; text-align:left; margin-bottom:0; l=
ine-height:135%; padding:10px 20px">
          <p style=3D"mso-line-height-rule:exactly">Defiant, Inc., 1700 Wes=
tlake Ave N STE 200&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly">Seattle, WA &nbsp;98109&nbsp;Unit=
ed States</p>
<p style=3D"mso-line-height-rule:exactly"><a href=3D"https://email.wordfenc=
e.com/hs/manage-preferences/unsubscribe-all?languagePreference=3Den&amp;d=
=3DVnbshC892TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29fm6J4V3WVmWcMV4ZKBH8N6-bxzc25t=
mTW4McwsJ92BG4RW96PdFZ7FMD3mV1yf0N2_-c9NW7wYvvs6byRJlW2nY5GL4fwh5s22M3&amp;=
v=3D3&amp;utm_campaign=3DWordfence%20Intelligence%20Marketing&amp;utm_sourc=
e=3Dhs_email&amp;utm_medium=3Demail&amp;utm_content=3D290340505&amp;_hsenc=
=3Dp2ANqtz-9FyUDmXxyvqaXGYhsSQMYqs-NDzeGcOgEAWha_3SAahSwJahz51Ib4NVYxqQ1GKw=
dBaqJRU6ElHEY8rl9KscUdADVz0Q&amp;_hsmi=3D290340505" data-unsubscribe=3D"tru=
e" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D=
"0" target=3D"_blank">Unsubscribe</a> <a href=3D"https://email.wordfence.co=
m/hs/manage-preferences/unsubscribe?languagePreference=3Den&amp;d=3DVnbshC8=
92TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29fm6J4V3WVmWcMV4ZKBH8N6-bxzc25tmTW4McwsJ9=
2BG4RW96PdFZ7FMD3mV1yf0N2_-c9NW7wYvvs6byRJlW2nY5GL4fwh5s22M3&amp;v=3D3&amp;=
utm_campaign=3DWordfence%20Intelligence%20Marketing&amp;utm_source=3Dhs_ema=
il&amp;utm_medium=3Demail&amp;utm_content=3D290340505&amp;_hsenc=3Dp2ANqtz-=
9FyUDmXxyvqaXGYhsSQMYqs-NDzeGcOgEAWha_3SAahSwJahz51Ib4NVYxqQ1GKwdBaqJRU6ElH=
EY8rl9KscUdADVz0Q&amp;_hsmi=3D290340505" data-unsubscribe=3D"true" style=3D=
"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0" target=
=3D"_blank">Manage Preferences</a></p>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-7-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-7-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VVTJb=
g2MQD9-W1gzqD792Zh1NW5GRJ1L58n_ygN4qMxL43qgyTW7lCdLW6lZ3l-W8m-qSn1L2q9MW7CK=
KCb5C6H_yW2d90H521pC9WW8Nmt0N2rfgX5W1bcjGX5YDqwlW106tS15QHPGRW5sc0rc3-CLf1W=
4gb4w17pTTXSN89lsHBPN3mNW533RKd4vTm6kW6BlTq47VJj1jW3wyWSb8xzTgFW726B771d5SD=
GN3T22t0ZCftnW68FwY45GnXNjW29N7YR980LCQW433Cm132zhP4W54s_f17vf_wdV1km4W3gfn=
S7N8nW9TLNs9VhW8MGCWG8xB1XcW16DKry76svvbW4mhT-w4Fcp_4W83fy5v2RbKFnf1JBFsj04=
" target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" d=
ata-hs-link-id=3D"0">
        <img alt=3D"ISO_27001" src=3D"https://email.wordfence.com/hs-fs/hub=
fs/ISO_27001.png?width=3D140&amp;upscale=3Dtrue&amp;name=3DISO_27001.png" s=
tyle=3D"outline:none; text-decoration:none; -ms-interpolation-mode:bicubic;=
 border:none; max-width:100%; font-size:16px" width=3D"70" align=3D"middle"=
 srcset=3D"https://email.wordfence.com/hs-fs/hubfs/ISO_27001.png?upscale=3D=
true&amp;width=3D140&amp;upscale=3Dtrue&amp;name=3DISO_27001.png 70w, https=
://email.wordfence.com/hs-fs/hubfs/ISO_27001.png?upscale=3Dtrue&amp;width=
=3D280&amp;upscale=3Dtrue&amp;name=3DISO_27001.png 140w" sizes=3D"(max-widt=
h: 70px) 100vw, 70px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-8" class=3D"hse-section hse-section-last" style=3D"pad=
ding-left:10px; padding-right:10px; padding-bottom:20px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border-bottom hse-border" styl=
e=3D"min-width:280px; max-width:600px; Margin-left:auto; Margin-right:auto;=
 border-collapse:collapse; border-spacing:0; border-left:0px solid #008cc1;=
 border-right:0px solid #008cc1; box-sizing:border-box; border-bottom:0px s=
olid #008cc1; background-color:#FFFFFF" bgcolor=3D"#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-bottom:0px solid #008CC1;=
border-left:0px solid #008CC1;border-right:0px solid #008CC1" cellpadding=
=3D"0" cellspacing=3D"0" role=3D"presentation" class=3D"hse-border-bottom h=
se-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-8-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module-8-0-0" class=3D"hs_cos_=
wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: i=
nherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_module-8-=
0-0_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_ric=
h_text" style=3D"color: inherit; font-size: inherit; line-height: inherit;"=
 data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><p styl=
e=3D"mso-line-height-rule:exactly; font-size:11px; line-height:175%; text-a=
lign:center" align=3D"center">You're receiving this email because you signe=
d up for Wordfence's WordPress security mailing list.</p></div></div></td><=
/tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div></div>
          </td>
        </tr>
      </tbody></table>
    </div>
 =20
<img src=3D"https://email.wordfence.com/e3t/Cto/GC+113/cwG7R04/VVTJbg2MQD9-=
W1gzqD792Zh1NW5GRJ1L58n_ygW4qMxtV3D2Fr7122" alt=3D"" width=3D"1" height=3D"=
1" border=3D"0" style=3D"display:none!important;min-height:1px!important;wi=
dth:1px!important;border-width:0!important;margin-top:0!important;margin-bo=
ttom:0!important;margin-right:0!important;margin-left:0!important;padding-t=
op:0!important;padding-bottom:0!important;padding-right:0!important;padding=
-left:0!important"></body></html>
------=_Part_3216850_1529249456.1705503945122--

