"The backdoor was discovered after a new corporate owner bought these plug-ins. Ginder said someone last year bought Essential Plugin and the backdoor was soon added to the plugins' source code."
"According to Ginder, this is the second hijack of a WordPress plugin discovered in as many weeks. Security researchers have long warned of the risks of malicious actors buying software and changing its code."
"While the plugins have been removed from WordPress' directory and now list their closure as 'permanent,' Ginder warned that WordPress owners should check if they still have one of the malicious plugins installed and remove it."
A backdoor was found in several WordPress plugins after a corporate acquisition of Essential Plugin, which has over 400,000 installs. The backdoor activated recently, pushing malicious code to websites using the plugins. This incident marks the second hijack of a WordPress plugin in two weeks, highlighting risks associated with ownership changes. WordPress users are not notified of such changes, increasing vulnerability to attacks. Affected plugins have been removed from the directory, and users are advised to check for and uninstall any malicious plugins.
Read at TechCrunch
Unable to calculate read time
Collection
[
|
...
]