Someone Planted Backdoors in Dozens of WordPress Plug-Ins Used in Thousands of Websites

Why It Matters

The breach demonstrates how undisclosed ownership changes can turn trusted plugins into attack vectors, jeopardizing millions of websites and their data. It highlights the urgent need for stronger supply‑chain security and transparency in the open‑source plugin market.

Key Takeaways

• Over 400,000 installs affected across 20,000 WordPress sites.
• Backdoor added after Essential Plugin sale, activated this month.
• WordPress directory removed plugins, but sites must manually delete them.
• Ownership changes of plugins are not disclosed to users.
• Second supply‑chain hijack in weeks highlights growing WordPress risk.

Pulse Analysis

WordPress powers roughly 43% of all websites, and its plugin marketplace is a cornerstone of that dominance. The open‑source nature of plugins encourages rapid development, but it also creates a soft target for malicious actors who can acquire a plugin portfolio, embed hidden code, and distribute it at scale. The Essential Plugin case illustrates how a seemingly routine business transaction—selling a collection of plugins—can become a conduit for a supply‑chain attack, affecting tens of thousands of sites without any warning to site owners.

The backdoor was inserted after the portfolio changed hands, remaining inert until it was triggered earlier this month. Once active, it pushed malicious scripts to any WordPress installation that retained the compromised plugins, exploiting the elevated privileges these extensions enjoy. With more than 400,000 installations and 15,000 paying customers, the potential exposure is massive. WordPress’s response was swift: the plugins were removed from the official repository and marked as permanently closed. However, the platform does not automatically purge installed plugins, leaving site administrators responsible for manual removal—a process many may overlook.

This incident reinforces the need for tighter governance around plugin ownership and distribution. Platforms should consider notifying users of ownership changes and implementing mandatory code‑review processes for transferred plugins. Site owners, especially those running e‑commerce or data‑sensitive sites, must adopt continuous monitoring tools to detect unexpected code changes. As supply‑chain attacks become more sophisticated, the WordPress community’s collective vigilance will be critical to safeguarding the broader web ecosystem.