TRUST#GRAFT Attack Turns WordPress Admin Sessions Into Persistent Backdoors

Security researchers have uncovered a WordPress attack chain that uses a victim's authenticated administrator session to install a persistent backdoor without first defeating the site's login controls.

Securonix Threat Research calls the campaign TRUST#GRAFT. The attack begins with JavaScript running in a browser where a WordPress administrator is already signed in. That trusted session becomes the delivery mechanism for a malicious plugin presented as "Web Media Optimizer."

Once activated, the plugin can hide from normal WordPress plugin views, retrieve and inject remote JavaScript, and maintain access after the original browser session ends. The technique shifts the security problem from password protection to session integrity. Multifactor authentication offers limited protection if an attacker can act through a browser that has already completed authentication.

The research matters because administrator sessions often carry the authority needed to upload plugins, change site code and reach sensitive content. A successful compromise can therefore turn a short-lived browser foothold into server-side persistence.

Defenders should review WordPress audit logs for unexpected plugin uploads or activations, inspect plugin directories directly rather than relying only on the administration console, and investigate outbound requests from unfamiliar PHP files. Administrators should also avoid using privileged sessions for routine browsing and should close or reauthenticate sensitive sessions after suspected browser compromise.

The findings reinforce a broader enterprise security lesson: a valid session is not proof that the activity occurring through it is legitimate.