Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them.
Last week, I wrote about catching a supply chain attack on a WordPress plugin called Widget Logic. A trusted name, acquired by a new owner, turned into something malicious. It happened again. This time at a much larger scale.
31Closed by WordPress.org
8 monthsBackdoor dormant before activation
6 figuresPaid on Flippa for the portfolio
A client reported a security notice they found in wp-admin.
Ricky from Improve & Grow emailed us about an alert he saw in the WordPress dashboard for a client site...
Read more at anchor.host