Aanvaller koopt 30 WordPress-plugins en plaatst backdoor in alle

An attacker purchased over 30 WordPress plugins on Flippa and injected a PHP deserialization backdoor into each one. After waiting eight months, the backdoor was activated across approximately 400,000 installations, with the attacker using Ethereum smart contracts for command and control communications. The incident highlights a significant security gap in WordPress.org's plugin ecosystem, as the platform lacks mechanisms to review plugin ownership transfers, a vulnerability that package managers like npm and PyPI addressed years ago.