New attacks against unfinished installations of WordPress aim to give attackers admin access and the opportunity to run PHP code.

The campaign, which was revealed by security specialist Wordfence, peaked during May and June when attackers targeted recently installed, but not configured, instances WordPress, SecurityWeek reported. Outsiders can use a successful attack to take over the new WordPress website and then potentially gain access to the entire hosting account.

Accessing WordPress Sites

According to the SecurityWeek article, many WordPress users install the platform by either unzipping the archive into a directory on their hosting account or by using a one-click installer from a hosting provider. But the process remains incomplete until a user creates a configuration file, and those who fail to complete installation leave themselves open to attack. In a blog post for Wordfence, chief executive Mark Maunder said his firm noticed that these high-level attackers started targeting unfinished WordPress installations.

Attackers scan for the setup URL and identify new instances of WordPress in which a user has uploaded the WordPress content management system but not completed the configuration. Such sites are open to outside connections, making it possible for external parties to access and complete the installation on the user’s behalf.

Malicious actors who discover an unfinished install can click through language selection and an introductory message before entering their own database-server information. WordPress then confirms that it can communicate with the database, allowing the outsider to complete installation, create an admin account and sign in to WordPress on the victim’s server.

The Dangers of PHP Code Execution

An attacker with admin access to a WordPress website can execute any PHP code and can undertake a range of malicious activities. Wordfence said a common action is to install a malicious shell in a hosting account. Such errant activity allows an attacker to access all files, websites and even databases on a WordPress account.

Wordfence suggested that there are several ways to complete this task, such as launching a theme and inserting PHP code, or creating and uploading a custom plug-in.

If news of the PHP code threat is not bad enough, a Wordfence report warned that the number of daily complex attacks against WordPress rose to 7.2 million in June 2017, up 32 percent from May. The average number of daily brute-force attacks increased by 36 percent month to month, with a peak level at more than 41 million.

Responding Effectively

Security experts suggested that incomplete WordPress installations remain a threat. One simple mitigation step is to complete configuration during the installation process. In his blog post for Wordfence, Maunder suggested that website admins could scan their hosting accounts for incomplete installations. Monitoring and auditing can also provide a further level of protection, he said.

Site owners should take note of the ever-growing threat from both unfinished WordPress installations and PHP code violations. They should work to fill potential security holes by completing configuration exercises, and by drawing on monitoring and auditing best practices.