Filtered by tag: supply chain attack × Clear
WordPress Plugins Compromised Without a Single File Change
Matched: WordPress
Attackers backdoored WordPress sites by injecting malicious code into a third-party JSON feed consumed by plugins, rather than modifying plugin files directly. Because no plugin files were altered, standard file-integrity checks failed to detect the compromise. The attack highlights the risk of plugins that pull external data, as that data can serve as an infection vector bypassing conventional security monitoring.
PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
Matched: WordPress
A supply chain compromise was discovered in the BdThemes WordPress plugin ecosystem, reported to Wordfence on August 7, 2026. The attack involved a poisoned API response affecting multiple plugins from the vendor. All affected plugins have been temporarily closed in the official WordPress plugins directory while the WordPress Plugins team conducts a full inspection and ongoing investigation.