From a 7 KB file to a 13-year backdoor operation
A security researcher discovered a long-running backdoor operation involving 27 WordPress plugins that had been active since 2013. The investigation revealed that a single operator used multiple accounts to distribute malicious code disguised as legitimate software.
Why it matters
This incident exposes significant vulnerabilities in open-source plugin ecosystems and the potential for long-term supply chain attacks.
Most plugin closures are uneventful. A developer stops responding, wp.org pulls the plugin, the listing goes dark, and that is the end of it. My WP Beacon scanner flags these all day long. I glance at them and move on.
The report is a technical breakdown of a security discovery based on forensic evidence.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in