TLDR Tech / InfoSec
Someone planted backdoors in dozens of WordPress plug-ins used in thousands of websites
A new corporate owner of WordPress developer Essential Plugin is accused of embedding backdoors into dozens of acquired plug-ins. These backdoors subsequently activated, pushing malicious code to thousands of websites using them. Austin Ginder of Anchor Hosting investigated the supply chain attack and released a list of affected plug-ins. While WordPress has removed these plug-ins from its repository, administrators are still required to manually check and uninstall them from their sites.
Read the full story