How Did a Single Buyer Acquire 30 Plugins Without Raising Alarms?

According to Anchor Host, the attacker contacted the original developers of each plugin — many of whom had not updated their code in years — and offered to buy the plugin's listing and user base. WordPress.org's plugin directory allows ownership transfer with minimal friction: a simple email confirmation from the current owner is sufficient. The attacker then released updates containing obfuscated backdoor code. No automated scan flagged the changes because the backdoor was hidden inside legitimate-looking configuration files. The Hacker News discussion, which surfaced the story on April 13, noted that the attacker likely used a script to mass-contact plugin authors, offering sums between $50 and $500 per plugin.

What Kind of Backdoor Was Planted, and How Was It Hidden?

The backdoor code, according to analysis shared in the Hacker News thread, allowed remote code execution via a specially crafted HTTP request. It was disguised as a caching optimization routine. The payload checked for a specific nonce value in the request headers; when present, it would execute arbitrary PHP commands. This is the same technique used in the 2021 Ninja Forms vulnerability, but this time the attacker controlled the entire plugin codebase, not just a single function. The backdoor was buried in a file named wp-content/plugins/plugin-name/includes/class-optimization.php, a location that typical static analyzers often skip because it is not a core entry point.

Which Plugins Were Affected, and How Many Sites Are at Risk?

Anchor Host did not publish the full list of 30 plugin names, citing responsible disclosure concerns. However, the Hacker News thread identified three plugins by name: "Simple Contact Form" (10,000+ active installs), "Quick Page/Post Redirect" (8,000+ installs), and "Custom Admin Bar" (5,000+ installs). Combined, the 30 plugins likely had between 50,000 and 100,000 active installations. The attacker targeted plugins that had not been updated in at least two years, ensuring that site owners were unlikely to notice suspicious new updates. According to a comment by user 'wpsec_analyst' on Hacker News, the attacker used a pattern: plugins with between 1,000 and 10,000 installs, no recent reviews, and a single author with no other active plugins.

Why Didn't WordPress.org's Security Team Catch This?

WordPress.org does not review plugin updates for security unless a vulnerability is reported. The plugin directory's automated scanner, Plugin Check (PCP), performs only basic syntax and compliance checks — it does not attempt to detect backdoors. According to a 2025 post on the WordPress Make blog, the team acknowledged that PCP "is not a security scanner" and that "malicious code can always be obfuscated to bypass static analysis." This incident proves that statement correct. The attacker's backdoor was designed to pass PCP because it used only standard WordPress functions and did not call any blacklisted APIs like eval() or base64_decode().

What Should Site Owners Do Right Now?

Site owners should immediately audit all plugins that have not been updated in over two years. If the plugin's author name changed recently, that is a red flag. The Hacker News thread recommends checking the plugin's changelog and comparing the current code against a known-good version from the WordPress plugin SVN repository. For high-risk sites, a file integrity monitoring tool like Wordfence or Sucuri can detect unexpected modifications. However, the most effective defense is to delete any plugin that is no longer actively maintained by its original developer — even if it appears to work fine.

1. By Q3 2026, Automattic will announce a mandatory security review for all plugin ownership transfers, following a public backlash and potential legal liability concerns.
2. At least one class-action lawsuit will be filed against a plugin author who sold their plugin to the attacker, arguing that the sale constituted negligence.
3. Wordfence will release a signature update within 30 days that detects the specific backdoor pattern, but it will not prevent future variants.

• Insight 1: The attacker's strategy of buying abandoned plugins is more scalable than finding zero-day vulnerabilities — it weaponizes neglect, not skill.
• Insight 2: WordPress.org's Plugin Check tool is worse than useless for this attack because it creates a false sense of security.
• Insight 3: The real solution is not better scanning but mandatory identity verification for plugin authors — a political fight Automattic will lose if they delay.
• Insight 4: Enterprise WordPress users will now demand a supply-chain bill of materials (SBOM) for every plugin, similar to what npm and PyPI are moving toward.
• Insight 5: This attack will accelerate the shift toward managed WordPress hosts that curate their own plugin whitelists, reducing the open ecosystem's value.