THIS WEEK: 3 WORDPRESS SUPPLY-CHAIN ATTACKS

 

🚨 Three Major WordPress Attacks Hit This Week — And These Aren't Ordinary Hacks




These are supply-chain attacks. Your website wasn't hacked directly. Instead, the companies behind the plugins you trust were compromised, and attackers used them as a gateway to infect WordPress sites.

Here's what happened:


⬛ ATTACK 01 — OptinMonster CDN


An UpdraftPlus vulnerability on an Awesome Motive marketing server allowed attackers to gain access and steal a CDN API key. They then injected malicious JavaScript into the CDN files of OptinMonster, TrustPulse, and PushEngage.

If your website loaded those files while you were logged in as an administrator, the malware could automatically create a hidden admin account and install a backdoor plugin—without any visible warning.More than 1.2 million websites were affected.


⬛ ATTACK 02 — ShapedPlugin Build Pipeline

Attackers breached ShapedPlugin's build pipeline, the system used to create and distribute plugin updates.They inserted a backdoor into the Pro plugin updates. If you installed the update through the normal WordPress update process, your site could become compromised.The free versions were not affected. Ironically, paying customers using the Pro versions became the primary targets.

CVE-2026-10735 | CVSS Score: 9.8


⬛ ATTACK 03 — Gravity SMTP API Leak


A vulnerable REST API endpoint lacked authentication, allowing anyone to retrieve approximately 365 KB of sensitive data, including email API keys, OAuth tokens, and email service credentials. Researchers observed more than 17 million exploitation attempts targeting this issue.

The Biggest Lesson

These three attacks used different entry points, but they all teach the same lesson:

Even if your WordPress core, themes, and plugins are fully updated, your website can still be compromised if a plugin vendor's CDN, build pipeline, or API infrastructure is breached. Trusting a plugin isn't just about its code—it's about trusting the vendor's entire security ecosystem. Stay informed. Verify your plugins. Monitor your websites. Security doesn't end with clicking "Update." If you need help checking whether your website is affected, feel free to send me a message.


#WordPressSecurity #WordPress #CyberSecurity #SupplyChainAttack #WebsiteSecurity #InfoSec #GetShielded


GetShielded


Comments

Post a Comment

Popular posts from this blog

Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

Image
An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code. According to Island, the extension, named Adblock for YouTube, has more than 10 million installs and carries a Featured badge on the Chrome Web Store. The extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) description states that it allows users to prevent web page elements like ads, including preroll ads, from being displayed on the video sharing platform, as well as on external sites that load YouTube. While the add-on offers the promised functionality, it also features capabilities to run arbitrary JavaScript code. "It also contains the architectural ingredients for arbitrary JavaScript execution on any website, activated by a single server-side configuration change, without an extension update, without a store review, and without any visible sign that something has changed," researchers Oleg Zaytsev and Shachar Gritzman said in a report share...
Read more

North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

Image
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft. According to JFrog, the packages "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core" mimic the legitimate "rollup-plugin-polyfill-node" project, down to the description, repository metadata, and package shape. "The lookalike packages place themselves in the same rollup, polyfill, core, and node naming space, which can look plausible during a quick dependency review," JFrog said in a technical write-up of the campaign. The campaign also involves four other packages, all of which have since been removed from the npm registry - quirky-token react-icon-svgs rollup-plugin-polyfill-connect swift-parse-stream What's noteworthy here is that "rollup-packages-polyfill-core" installs and loads "swift-parse-stream," while "rollup-runt...
Read more

Is Your Hosting Really Protecting You?

Image
In June 2026, security researchers discovered a new malware called Gaslight. It was specifically designed to evade AI-powered malware analysis tools that researchers increasingly rely on. This malware primarily targets macOS, not WordPress directly. However, the underlying technique is a wake-up call for everyone. It proves that malware can be engineered to bypass AI-based detection, just as it can evade traditional security plugins and scanners. According to IBM's 2026 report, attacks against public-facing applications, including websites, increased by 44% over the past year. That's why I always say: running a scan alone is not security. It's only the first step of an investigation. Whether it's AI or a conventional scanner, security tools can only detect what they've been trained or programmed to recognize. A skilled security investigator, however, looks beyond automated results to uncover what's actually there. If your website shows a clean scan but something...
Read more