Someone has apparently snaffled up 31 WordPress plugins and wedged a backdoor in each one
An individual reportedly purchased 31 WordPress plugins and inserted backdoors into each one, with the malicious code being activated around April 5, 2026. The incident highlights a vulnerability in WordPress.org's system, which lacks a mechanism to flag or review plugin ownership transfers, potentially leaving users unaware of compromised software.
- Entities
- Topic: Software Supply Chain Attacks
- Platform: WordPress
- Topic: Cybersecurity
- Topic: Plugin Ownership Transfers
- Company: Essential Plugin
This article was reported and published by pcgamer.com. feed.gg links to it as part of a story cluster — full text, images and rights remain with the publisher.