See More

Security Firm Issues Warning About WordPress Crypto Widgets 

2 mins
Updated by Kyle Baird
Join our Trading Community on Telegram

In Brief

  • Cyber Security Agency of Singapore warns of hackers exploiting WordPress plugin vulnerabilities.
  • SQL Injection technique used to access sensitive data through price ticker and coins list plugins.
  • Protect your crypto assets by staying informed and securing your website against potential threats.
  • promo

Singapore’s cyber security regulators caution that websites employing WordPress crypto widgets, especially price ticker and coins list plugins, can extract sensitive visitor information.

This reiterates the growing sophistication of hackers in their efforts to steal cryptocurrency.

WordPress Crypto Widgets At Risk

The Cyber Security Agency of Singapore (CSA) explained that hackers use SQL Injection to exploit WordPress crypto widgets’ price ticker plugins. This technique targets data-driven applications, posing a serious security risk.

“Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the ‘coinslist’ parameter in versions 2.0 to 2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.”

From there, it was explained that users are subject to their sensitive information being extracted from the hackers, which puts sensitive information such as passwords and even crypto wallets at risk.

Read more: What Is a Rug Pull? A Guide to the Web3 Scam

“This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.”

In recent times, hacking has grown increasingly sophisticated, fueled by the growing amounts of money in the crypto industry.

In December 2023, BeInCrypto reported hackers conducting phishing campaigns on Google and social media, resulting in the theft of millions of dollars in crypto from victims.

“A ‘Wallet Drainer’ has been linked to phishing campaigns on Google search and X ads, draining approximately $58M from over 63K victims in 9 months.”

However, Chainalysis highlighted in its recent crime report that revenue from crypto hacking decreased by approximately 54.3% in 2023 compared to the previous year.

Total Cryptocurrency value received by illicit addresses, 2018-2023. Source: Chainalysis
Total Cryptocurrency value received by illicit addresses, 2018-2023. Source: Chainalysis

Furthermore, Scam Sniffer found that Wallet Drainers took about $295 million from around 324,000 victims in 2023.

However, while hacking attacks have a widespread impact, the community usually responds quickly, usually within 10-50 minutes. 

Read more: 15 Most Common Crypto Scams To Look Out For

Meanwhile, Scam Sniffer notes that airdrops, organic traffic, paid advertising, and hijacked Discord links are not as easily detected.

However, individuals in the crypto industry must remain vigilant against crypto wallet hacks and also their social media accounts.

Hackers are increasingly targeting influential social media accounts to spread malicious links to a large following, which presents a potentially more lucrative opportunity for them.

In September 2023, Ethereum co-founder Vitalik Buterin had his X (formerly Twitter) account compromised. Shortly after hackers took control of the account, they posted a fraudulent ConsenSys link, swindling almost $700,000 from unsuspecting followers.

Top crypto projects in the US | April 2024



In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and ConditionsPrivacy Policy, and Disclaimers have been updated.

Ciaran Lyons
Ciaran is a cryptocurrency journalist based in Sydney, Australia. He particularly enjoys writing about CBDC developments and the practical implementations of cryptocurrency in real-world scenarios. He has also appeared across major television networks in Australia including Channel Ten, Channel Nine and SBS TV. Prior to his foray into cryptocurrency, Ciaran worked as a presenter on national radio station Triple J.