A newly documented attack uses a WordPress administrator’s active browser session to install a concealed backdoor—without stealing or guessing their password. Researchers say the TRUST#GRAFT chain can be triggered when an administrator visits a compromised page while signed in. The incident is a reminder that everyday browsing habits can put a website at risk.
Key takeaways
- The attack relies on an administrator already being logged in and having permission to install plugins; it is not a login bypass.
- A fake security-check screen helps disguise the activity while the browser installs a malicious plugin.
- The malware copies itself into a WordPress folder that does not show up in the usual Plugins list.
- Separate browser profiles, restricted permissions and routine site checks can reduce the risk.
How the attack uses a trusted session
Researchers at Securonix named the attack chain TRUST#GRAFT. Its JavaScript loader waits for a signed-in WordPress administrator to visit a compromised webpage. It then displays a convincing, full-screen imitation of a Cloudflare verification prompt, while gathering information about the visitor’s device and checking for signs of security analysis tools.
The script uses the administrator’s existing login cookies to access WordPress and retrieve a security token. It then uploads a ZIP file through the site’s normal plugin installation process and activates the plugin. Because the browser is already authorised, the requests can appear legitimate. Securonix has not confirmed how the initial script was added to the compromised page.
A backdoor designed to stay hidden
The uploaded plugin is called Web Media Optimizer 2.1, a name intended to sound like an ordinary media utility. Researchers say it can inject remote JavaScript into public pages and weaken certificate checks when contacting its controller. It can also set an administrator login cookie using a hardcoded token.
On activation, the plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php. WordPress automatically loads files in this must-use plugins folder, and they do not appear on the standard Plugins screen. As a result, deleting only the visible plugin may leave the backdoor in place—and the site exposed to reinfection.
Steps site owners can take
Avoid using the same browser profile for everyday browsing and WordPress administration. Sign out of the dashboard when it is not needed, and limit plugin-installation rights to accounts that genuinely require them. If an administrator may have visited a suspicious page while logged in, investigate promptly rather than relying on a routine scan alone.
A thorough cleanup should include checking the must-use plugins folder, removing unauthorised files and scripts, and reviewing administrator accounts and credentials. A WordPress maintenance plan or care plan can help make regular checks, updates and security reviews part of the site’s routine. For ongoing protection, site owners should also monitor for unexpected PHP files and investigate any changes they cannot explain.