Hackers Insert Backdoors in Popular WordPress Plugins

Dozens of WordPress plugins have been compromised with malicious code following a corporate acquisition. Security researchers discovered that the hijacked plugins, used by thousands of websites globally, were implanted with backdoors enabling unauthorized access to infected systems.

A significant security incident has emerged targeting the WordPress ecosystem, one of the most widely used content management systems powering approximately 43% of all websites worldwide. According to security researchers, multiple WordPress plugins were compromised after being acquired by a new corporate owner, with attackers successfully injecting backdoor code into the compromised software.

The malicious modifications allowed unauthorized access to websites running the affected plugins. The backdoors functioned as hidden entry points, enabling attackers to gain control over infected systems without proper authentication. This type of supply chain attack represents a serious threat to website security, as legitimate software updates are often trusted implicitly by administrators.

The affected plugins maintained significant user bases across thousands of websites. Users of these plugins likely received what appeared to be routine security updates or maintenance patches, unaware that malicious code was being delivered alongside standard functionality. This scenario exemplifies how compromised supply chains in software distribution can affect large portions of the internet simultaneously.

Security vendors and WordPress administrators have been notified of the compromise. Website owners using the affected plugins are advised to audit their systems for unauthorized access, change administrative credentials, and implement additional monitoring. This incident underscores the ongoing vulnerability of open-source software ecosystems and the importance of rigorous security practices during corporate acquisitions of widely-used applications.

The discovery highlights the critical need for stronger security verification processes when established software projects change ownership, as attackers increasingly target popular tools to maximize their reach and impact across the internet.