Story
Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them
1 report
1 website
1 discussion
Latest report
Overview
A supply chain attack compromised 30 WordPress plugins, including Countdown Timer Ultimate, after a trusted developer was acquired by a new owner. The WordPress.org Plugins Team issued a security notice regarding the malicious backdoor found in these plugins.
Summary from anchor.host.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · anchor.host
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-04-14.
- Praise: The FAIR package manager's architecture, inspired by atproto, could significantly mitigate supply-chain attacks by decentralizing package repositories and enhancing security.
- Praise: The recognition of the supply chain attack surface in WordPress plugins highlights the need for better security practices among developers, potentially leading to improved overall security in the ecosystem.
- Concern: The reliance on numerous small plugins from individual developers in WordPress creates a dangerous supply chain attack surface, as many developers lack a security-focused approach.
- Concern: The ease with which attackers can buy established plugins with user trust underscores the vulnerability of the WordPress ecosystem to sophisticated supply chain attacks.