Russian malware SoakSoak infects 100k+ self-hosted WordPress sites, uses known vulnerability in RevSlider plug-in
Report: Mysterious Russian Malware Is Infecting 100,000+ Wordpress Sites — A Russian malware called SoakSoak has infected over 100,000 Wordpress sites since this Sunday, turning blogs into attack platforms.
Context & Ripple Effects
SoakSoak is an early entry in what becomes a recurring WordPress infection cycle documented across this corpus: a single vulnerable plug-in becomes the vector for six-figure compromises. It exploits a known RevSlider flaw rather than anything novel, which is precisely why the scale is so large — the fix existed and was simply not applied.
The pattern repeats after it: an hijack campaign hitting thousands of sites within 15 days in 2015, an actively exploited WordPress bug endangering millions of sites, and the LiteSpeed Cache critical flaw that left millions still exposed years on. SoakSoak is the template case for why self-hosted WordPress keeps producing these waves.
First-order effects
- Owners of the 100,000+ compromised self-hosted sites face cleanup and patching of RevSlider, while their visitors are now exposed because the blogs have been converted into attack platforms.
Second-order effects
- Hosts and security vendors get pulled into scanning for known plug-in flaws at fleet level, since individual owners demonstrably leave known vulnerabilities unpatched — shifting defense upstream of the site owner.
Third-order effects
- If the pattern holds, responsibility for patching drifts from millions of self-managed installs toward managed hosting platforms and automated update enforcement, with third-party plug-ins treated as standing attack surface rather than trusted extensions.
The trend: WordPress's third-party plug-in ecosystem keeps generating mass-exploitation campaigns — SoakSoak via RevSlider, then repeated hijack waves and the LiteSpeed Cache flaw — driving security responsibility away from individual site owners.