CVE-2025-8047

The disable-right-click-powered-by-pixterme (up to v1.2) and pixter-image-digital-license (up to v1.0) WordPress plugins load a JavaScript file from an apparent abandoned S3 bucket [1]. The file has been compromised and can be controlled by the bucket owner. Currently, it displays an alert marketing security services, but an attacker could modify it to execute arbitrary code on affected sites [1].

Attack

Vector Attackers who gain control of the S3 bucket can serve malicious JavaScript to any site using these plugins. No authentication or user interaction is required beyond the plugin being active and the bucket being accessible. This is a supply chain compromise affecting the plugin's remote resource [1].

Impact

An attacker can execute arbitrary JavaScript in the context of affected WordPress sites, potentially leading to full site compromise, data theft, or further injection attacks. The plugins effectively act as a backdoor for the bucket controller [1].

Mitigation

No official patches are available. The researcher recommends removing these plugins immediately and not using them until a verified update is released [1]. Sites should also review for any signs of compromise.