TECHBOARD #1: Citrix Needs More Patches, Attackers Hide Admin Accounts in WordPress

Real world hacks:

Malicious WordPress Orders Can Give Attackers Access to Websites

Patchstack reported on a campaign exploiting stored XSS vulnerabilities in the WPC Product Bundles and Ninja Forms plugins. The first attempts were recorded on October 4 and 5. The plugins have over 30,000 and 500,000 active installations, respectively, although these figures do not indicate how many websites have been compromised.

Attackers inject malicious code into an order or form submission. When an administrator views the affected data, the code exploits their active session. Without needing a password, it installs a malicious plugin and creates administrator accounts.

The attack establishes several ways to maintain access: a visible account, a hidden account, a login link for the oldest existing administrator account, and a file manager that requires no authentication. Removing the malicious plugin does not eliminate accounts or backdoors stored outside it.

Administrators should install the latest versions of WPC Product Bundles and Ninja Forms, which also include additional security fixes. If malicious code execution is suspected, the user database, files, and mu-plugins should all be examined. Manipulated file timestamps mean that checking only recent changes is insufficient. The absence of the imgcdn1.com domain from server logs does not rule out a compromise.

In the event of a compromise, unauthorized access must be removed, and privileged passwords, WordPress authentication keys, and salts must be changed. Even the oldest administrator account may be compromised without its password being stolen. Patchstack has so far observed a limited number of attempts involving the two plugins in its telemetry. For penetration testers, this highlights the importance of testing how user-submitted data is displayed in administration interfaces.

Vulnerability Landscape:

Citrix NetScaler continues to receive security updates after Citrix confirmed active exploitation of two vulnerabilities in September. CVE-2026-88771 allows unauthenticated attackers to execute commands without requiring additional features to be enabled. CVE-2026-88772 may lead to code execution or service disruption when DTLS is enabled, which is the default setting on VPN virtual servers. Another vulnerability, CVE-2026-88779, disclosed on October 3, threatens availability in configurations using SAML SP or IdP. Affected deployments require a newer patch.

However, applying updates may not eliminate the consequences of an existing compromise. CERT-EU described an attack involving a web shell that enables attackers to control the device through a web interface. Organizations should preserve evidence, apply updates without delay, and investigate system integrity and the potential scope of the incident.

GitLab has warned about the actively exploited vulnerability CVE-2026-85706, which may allow unauthenticated attackers to access files stored on the server under certain conditions. Organizations running self-managed installations should verify that they are using a patched version. According to GitLab, GitLab.com and GitLab Dedicated are already protected against this vulnerability.

However, an attempt to read a file does not necessarily mean its contents were leaked. Investigators must determine what data the server actually transmitted to the attacker. The HTTP response status code alone is insufficient. Before updating or restarting systems, preserve logs and then verify the data transmitted using GitLab's recommended procedure.

Tools Worth Exploring

SnafflePy and PyGroup3r help identify sensitive files and risky Group Policy configurations. Their Python implementations simplify testing. The severity of findings depends on the level of access available and the potential impact.

ADCS_Tools help test the exploitation of Certificate Enrollment Web Service (CES) in Active Directory Certificate Services (AD CS). Relaying authentication traffic may allow attackers to obtain certificates for another identity. The risk depends on configuration and authentication protections.

AI/LLM Updates

TypeSafe AI introduced its Jev model, designed to support decision-making in software processes. In cybersecurity, potential applications include classifying security alerts as urgent, lower priority, or requiring further investigation. However, correctly formatted outputs and high reported confidence do not guarantee accurate decisions. Before deployment, organizations should specifically test scenarios in which the model incorrectly classifies a genuine threat as harmless.

CITADELO News:

• Across 43 cloud penetration testing projects, we identified 18 critical and 44 high-severity vulnerabilities. Cloud projects recorded the highest density of vulnerabilities overall, with 42% containing at least one critical finding.

• The most common critical weakness in web applications and APIs remains insufficient access control. Connected components also introduce risks, including vulnerable libraries, exposed API keys, and forgotten accounts. Organizations should therefore continuously test applications and their surrounding environments, maintain an inventory of APIs, and enforce authorization checks directly on the server.

Do You Know What Vulnerabilities Are Hiding in Your Systems?

Cyber threats are constantly evolving. Penetration testing helps you identify security weaknesses before attackers can exploit them. Assess the resilience of your applications, infrastructure, and systems with the help of ethical hackers.