Someone planted backdoors in dozens of WordPress plugins used in thousands of websites

Dozens of plugins for the widely used open source web blogging software WordPress are now offline after a backdoor was discovered in them, used to push malicious code to any website that relied on the plugins. The backdoor was discovered after a new corporate owner bought these plug-ins. Anchor Hosting founder Austin Ginder sounded the alarm in a blog post last week describing a supply chain attack on a WordPress plugin maker called Essential Plugin. Ginder said someone last year bought Essential Plugin and the backdoor was soon added to the plugins’ source code. The backdoor sat dormant until earlier this month when it activated and began distributing malicious code to any website with the plugins installed.