Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Description

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Confirmed malicious builds (others might be affected as well):
google-maps-easy-pro - 1.6.9
supsystic-gallery-pro - 2.10.9
tables-generator-pro - 1.9.20

Indicators of compromise:
- Plugin auto-updating with a backdoor injected in index.php, which allows unauthenticated RCE via magic HTTP header. Any request carrying the header X-Forwarded-Validation: supsystic-cdn-82a7 gets a full command shell (POST body or c param) and an arbitrary file-read / URL-fetch primitive (?asset=). A plain GET with the header returns the string cdn-ok — a trivial infection-confirmation fingerprint.
- Second RCE where ?x=ss99&c=<command> executes arbitrary OS commands, no authentication.
- Authentication bypass - Presenting the correct token (sha256(secret_key + home_url)) via ?_wplogin=, ?wph=, or ?_wpnc= logs the attacker straight in as the first administrator with a persistent auth cookie — no password needed.
- Rogue administrator creation + credential exfiltration - Rogue admin username: wp_ + first 6 hex chars of md5(home_url()) (deterministic per-site). Password: first 16 hex chars of md5(secret_key + home_url + 's2') (deterministic — attacker can recompute it for any site). The cleartext password, site URL, server IP, and WP/PHP versions are exfiltrated to https://updates.supsystic.com/beacon with TLS verification disabled.
- Malicious forced auto-update (persistence / supply-chain propagation) - The backdoor injects fake update entries (fabricated versions that don't exist in changelogs and 99.0.1) pointing the package URLs at attacker-controlled ZIPs over plaintext HTTP, and forces auto_update_plugin to true for both free and pro versions of plugins.