A sophisticated supply chain attack has compromised the GravityForms WordPress plugin, a widely used tool for creating forms on WordPress sites. This breach has introduced malicious code capable of remote code execution on affected websites.
The attack was identified on July 11, 2025, when researchers observed unusual HTTP requests to the domain gravityapi.org originating from GravityForms. This domain was registered just days prior, indicating a well-planned operation. The malicious code was embedded in version 2.9.12 of the plugin and was distributed through official channels, including manual downloads and composer installations.
Upon discovery, the developers at RocketGenius acted swiftly to remove the compromised version and released a clean update, version 2.9.13, by July 7, 2025. Additionally, the malicious domain was suspended to prevent further exploitation.
The malware utilized two primary methods to gain control over infected sites. The first involved a function named update_entry_detail() within the plugin’s common.php file. This function collected extensive system information, such as WordPress version, active plugins, user counts, and server details, and transmitted this data to the attacker’s server. The server’s response included base64-encoded payloads that were saved to the site’s file system, establishing persistent backdoors.
The second method employed a function called list_sections(), creating a backdoor system that required a specific API token for access. This backdoor allowed attackers to:
- Create administrator accounts with full privileges.
- Execute arbitrary PHP code.
- Upload malicious files to the server.
- List and delete existing user accounts.
- Perform comprehensive directory traversals.
- Maintain persistent access even after discovery.
While the full extent of the attack is still under investigation, initial assessments suggest that the infection was not widespread, likely due to the short window during which the malicious version was available. Major web hosting companies have begun scanning their servers for signs of compromise, with results indicating limited distribution.
This incident highlights the vulnerabilities inherent in software supply chains, where even trusted sources can be compromised. The advanced techniques used in this attack, including multiple backdoors and comprehensive system access capabilities, demonstrate the evolving sophistication of cyber threats.
Indicators of compromise include suspicious IP addresses (185.193.89.19 and 193.160.101.6), malicious files (bookmark-canonical.php and block-caching.php), and the specific API token used by the backdoor system. Organizations using GravityForms are advised to update immediately to version 2.9.13 or later, conduct thorough security scans of their WordPress installations, and monitor for any unauthorized administrator accounts or suspicious file modifications.
This breach underscores the critical importance of maintaining robust security monitoring and implementing enhanced supply chain security measures within the software development ecosystem.
