Incident Score: Analysis & Impact (WEP1780050340)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), with evidence including severe security flaw in the WP Maps Pro WordPress plugin, and improperly secured AJAX action and External Remote Services (T1133) with moderate to high confidence (80%), with evidence including unauthenticated attackers to create administrator accounts, and login URL that authenticated the attacker. Under the Privilege Escalation tactic, the analysis identified Valid Accounts: Local Accounts (T1078.003) with high confidence (95%), with evidence including generate a new administrator account with full administrator privileges, and hardcoded email [email protected] and Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate to high confidence (70%), with evidence including bypassing a publicly exposed nonce, and lack of capability check in AJAX action. Under the Persistence tactic, the analysis identified Create Account: Local Account (T1136.001) with high confidence (90%), with evidence including create administrator accounts, and randomly generated username (e.g., fc_user_*) and Server Software Component: Web Shell (T1505.003) with moderate to high confidence (70%), supported by evidence indicating install malicious plugins, Inject backdoors, Deploy webshells. Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating lack of capability check to restrict the vulnerable endpoint and Valid Accounts: Local Accounts (T1078.003) with moderate to high confidence (80%), supported by evidence indicating authenticated the attacker without requiring a password. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), with evidence including steal site data, and potentially PII/payment data stored on compromised sites. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), with evidence including data breach impacting over 15,000 installations, and potential PII/payment data exfiltration. Under the Impact tactic, the analysis identified Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating full site takeover, unauthorized administrative access and Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), supported by evidence indicating modify themes, Inject backdoors. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.