WordPress Plugin Flaw Leads to 3,300 Sites Hacked

In January, Sucuri researchers discovered the Balada Injector malware affecting over 7,100 WordPress sites via a Popup Builder plugin vulnerability. This campaign, starting December 13, exploited the flaw (CVE-2023-6000, CVSS 8.8) in earlier Popup Builder versions. Recently, over 3,300 websites fell victim to this issue, with Sucuri’s SiteCheck finding Balada Injector on 1,170 sites.