Balada Injector Infects Over 7,100 WordPress Sites Using Plugin Vulnerability

Thousands of WordPress sites have been compromised by the Balada Injector campaign exploiting a high-severity Popup Builder flaw (CVE-2023-6000, CVSS 8.8) to inject JavaScript hosted on specialcraftbox.com, install backdoor plugins (e.g., wp-felody.php, sasas), create rogue administrators, and redirect visitors to scam pages; Sucuri observed over 7,100 sites affected in the latest wave and the operation has reportedly been active since 2017 with wide impact.