Attempted hacker attack on WordPress plugins: analysis of the situation and recommendations for protection

Recently, WordPress plugins have come under attack from hackers who use stolen credentials (from other data leaks) to gain direct access to the plugin code. These attacks are of particular concern because they can get inside because the compromise appears to users as plugins with a normal update.

"A software supply chain attack occurs when a cybercriminal infiltrates a software vendor's network and uses malicious code to compromise the software before the vendor ships it to its customers. The compromised software then compromises the customer's data or system. Newly purchased software may be compromised from the outset, or the compromise may occur through other means, such as a patch or hotfix." - US Cybersecurity and Infrastructure Security Agency (CISA)

In this particular case of the WordPress plugin attack, the attackers use stolen credentials to access developer accounts that have direct access to the plugin code to add malicious code to the plugins in order to create admin accounts on all websites that use the compromised WordPress plugins.🚀

• 📌 Wordfence today announced that additional WordPress plugins have been identified that have been compromised.
• 📌 It's important to understand what's going on and be proactive about protecting the sites under your control.
• 📌 Wordfence released a report that more plugins were compromised, including a very popular podcasting plugin called PowerPress Podcasting plugin by Blubrry.