The Manager for IcoMoon plugin, also listed as Manager for Icommon, was affected by a vulnerability that allowed attackers to upload and extract files within a WordPress installation. In the incidents described in this article, attackers used the uploads directory to place potentially malicious files. Missing front-end icons or IcoMoon settings reverting to their defaults were among the symptoms we observed.
For details about the reported vulnerability, see Wordfence’s Manager for IcoMoon vulnerability entry.
If you suspect a compromise, have the entire installation reviewed. Restoring a known-clean backup and addressing the entry point are important parts of recovery. At the time of the original incident, we created a temporary patch for Manager for IcoMoon. That historical patch is not a substitute for a security review or a maintained replacement plugin.
