•1 min read•from InfoQ
Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them
An attacker purchased 30+ WordPress plugins on Flippa for six figures, planted a PHP deserialization backdoor in the first commit, and waited eight months before activating it across 400,000 installations. The attack used Ethereum smart contracts to resolve C2. WordPress.org has no mechanism for reviewing plugin ownership transfers, a gap that npm and PyPI addressed years ago.
By Steef-Jan WiggersWant to read more?
Check out the full article on the original site
Tagged with
#natural language processing for spreadsheets
#generative AI for data analysis
#Excel alternatives for data analysis
#rows.com
#WordPress
#plugins
#Flippa
#backdoor
#PHP
#deserialization
#C2
#Ethereum
#smart contracts
#installs
#ownership transfers
#supply chain
#attacker
#commit
#security
#npm