ATTACKER BUYS 30 WORDPRESS PLUGINS, ADDS BACKDOORS

INDUSTRY DESK■ 1 MIN READ

MON, APR 13, 2026

A threat actor purchased 30 WordPress plugins and injected backdoor code into all of them, potentially exposing thousands of websites. The compromised plugins have since been identified and removed from the WordPress repository.

Security researchers discovered that an individual acquired ownership of multiple WordPress plugins through the official marketplace and systematically added malicious code to each one. The backdoors allowed unauthorized access to affected websites. The plugins remained available for download before detection, meaning site administrators who installed or updated them during the window of compromise may have been affected. WordPress has removed the malicious plugins and notified affected users. This incident highlights vulnerabilities in how plugin ownership transfers are handled and the risks of relying on third-party code without verification. WordPress plugin supply chain attacks have increased in frequency, with attackers recognizing the ecosystem's reach across millions of websites. Site owners are advised to audit their installed plugins, remove any from the compromised list, and implement security monitoring to detect unauthorized access.

■ MORE FROM THE SECURITY DESK

P522CISA ORDERS FEDS TO PATCH CITRIX NETSCALER RCE BY SATURDAY

The U.S. Cybersecurity and Infrastructure Security Agency has issued a mandate requiring all federal agencies to patch an actively exploited remote code execution vulnerability in Citrix NetScaler appliances by Saturday.

JUST NOW— Security Desk

P513GPUTHOR ATTACK BREACHES NVIDIA GPU SECURITY

A new Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service attacks and root-level privilege escalation.

11H AGO— Industry Desk

P498FBI DISRUPTS CHINESE HACKING TOOLS TARGETING US AGENCIES

The FBI has dismantled proxy tools used by Chinese hackers in a widespread campaign against NASA, the Federal Reserve, the US Senate, and the Justice Department. The operation marks a significant coordinated response to months of intrusions into critical US infrastructure.

16H AGO— Security Desk

P482SNOWFLAKE KILLS SERVICE-ACCOUNT PASSWORDS

Snowflake is phasing out password authentication for legacy service accounts, requiring organizations to adopt passwordless methods. The real challenge: identifying which accounts exist, who manages them, and what access they hold.

22H AGO— Industry Desk

◄ BACK TO NEWS

ATTACKER BUYS 30 WORDPRESS PLUGINS, ADDS BACKDOORS

■ MORE FROM THE SECURITY DESK

■ SUBSCRIBE TO THE DAILY BRIEF