Introduction to the WooCommerce Plugin Version Check Scam

Beware! A new phishing scam – the WooCommerce Plugin Version Check scam – is actively targeting WordPress users with WooCommerce plugins. The scammers are sending phishing emails that impersonate legitimate WordPress communications. Scammers aim to trick unsuspecting domain owners into visiting fake websites at update-plugins.org and wrdp-update.org, designed to mimic the official WordPress.org site. Both domains registered yesterday on October 22, 2024, making this scam brand new and likely to catch many people off-guard.

How the WooCommerce Plugin Version Check Scam Operates

The phishing email claims there are vulnerabilities in WooCommerce that require immediate attention. It prompts the recipient to click a link and log in to verify or update their plugin. Clicking the link redirects the user to the scam site. The site mimics WordPress’s branding to appear legitimate. If the user enters their credentials, the scammers gain unauthorized access to the victim’s WordPress installation, leaving the door wide open for further malicious activity such as stealing personal data, injecting malware, or even defacing websites.

Screenshots of the Phishing Attempt

The scammer sent the phishing email to CharlesWorks as part of their attempt. Below is a screenshot of the actual email.

Notice that the email displays no images. My web version of Outlook blocks automatic image downloads from unknown senders. This important security feature prevents the sender from confirming whether I received and opened the email. I strongly encourage everyone to configure their email client similarly to block images by default.

The following screenshot captures the fake WooCommerce plugin check page on the phishing domain:

How Phishing Scams Work

Phishing scams rely on social engineering tactics to exploit human psychology. Attackers design emails to look authentic, often imitating trusted entities like WordPress or your web host. They prey on urgency—claiming your website is vulnerable, your account will be suspended, or that your plugins need immediate attention. This particular scam is especially dangerous because it leverages WooCommerce, a plugin many businesses rely on to operate online stores, thus increasing the likelihood of someone acting without thinking.

How to Protect Yourself

Here are some best practices to follow to avoid becoming a victim of phishing:

1. Verify the Sender’s Email Address – Be cautious of emails with unusual sender addresses or unexpected messages.
2. Hover Over Links Before Clicking – Check if the URL matches the legitimate site. In this case, update-plugins.org is a clear red flag.
3. Enable Image Blocking in Your Email Client – As shown in the screenshots, this prevents attackers from knowing if their message was opened.
4. Contact the Source Directly – If you receive suspicious emails, contact WordPress or the plugin provider directly to confirm.
5. Use Multi-Factor Authentication (MFA) – Enable MFA for your WordPress account to prevent unauthorized access, even if your password is compromised.
6. Be Skeptical of Urgent Requests – Scammers often use urgent language to push you into making rash decisions.

Important Note about CharlesWorks and WordPress Communication

CharlesWorks NEVER sends emails asking users to click on links to check or update plugins. From my experience, WordPress also does not email users in this way. Treat any such communication as suspicious and investigate it thoroughly before taking any action.

More Resources on Phishing Scams

To learn more about phishing scams, how they operate, and how to protect yourself, visit the Federal Trade Commission’s (FTC) phishing resource page.

Some articles regarding phishing and other scams we’ve put out are here:
Beware of BOI Filing Scams Targeting Small Businesses
Caution: The “Pig Butchering” Phishing Expedition
Avoiding New Phishing Pitfalls: A Personal Encounter

Some solutions that can help:
CleanTalk: The Best Security and AntiSpam Plugin Used by CharlesWorks

UPDATE 10/24/2024

We are pleased to report that the two domains mentioned have been taken down after being reported through their registrar’s abuse channels. Hopefully this minimizes the damage done by the criminals perpetrating these cybercrimes.

We at CharlesWorks care about out clients. Stay safe out there, and remember: Always use caution before you click!