Archive — US — techcrunch
Someone planted backdoors in dozens of WordPress plug-ins used in thousands ofwebsites
Dozens of WordPress plug-ins were taken offline after a backdoor was found, allowing malicious code to spread to thousands of websites. Discovered by Anchor Hosting's Austin Ginder, the backdoor was integrated after the purchase of the plug-in maker Essential Plugin, affecting over 20,000 installations. Users are urged to remove the compromised plug-ins and security experts highlight ongoing risks from supply chain attacks.
Key points
- A backdoor was found in various WordPress plug-ins, allowing malicious code to spread.
- The backdoor was introduced after Essential Plugin was bought by a new corporate owner.
- The backdoor became active earlier this month, impacting over 20,000 websites.
- Anchor Hosting's Austin Ginder alerted the community about this supply chain attack.
- WordPress users are not notified when plug-ins are sold, increasing vulnerability to attacks.
- This incident is the second known hijack of a WordPress plug-in in recent weeks.
Why it matters
- The incident underscores ongoing supply chain security concerns, relevant in the context of the 2025 IT landscape prioritizing software integrity and transparency.
- Historically, software hijacking incidents have led to significant breaches, raising alarms about the need for better monitoring and controls in third-party software dependencies.
This incident illustrates the critical need for vigilance among WordPress users and developers regarding plug-in security, especially in light of evolving threats in the software supply chain.