WordPress Plugin Exploited to Steal Credit Card Data from E-commerce Sites

Unknown threat actors abused the Dessky Snippets WordPress plugin to plant server-side PHP skimming code on WooCommerce sites, adding fake billing fields (with autocomplete disabled) to capture cardholder data and exfiltrate it to https://2of.cc/wp-content/. Sucuri observed the campaign on May 11, 2024; site owners are advised to update plugins, use strong credentials, and audit for unauthorized changes.