New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Malicious backdoors affect thousands of WordPress websites
Someone planted backdoors in dozens of WordPress plug-ins used in thousands of websites
Dozens of plug-ins for the widely used open source web blogging software WordPress are now offline after a backdoor was discovered in them, used to push malicious code to any website that relied on the plug-ins. The backdoor was discovered after a new corporate owner bought these plug-ins.
Anchor Hosting founder Austin Ginder sounded the alarm in a blog post last week describing a supply chain attack on a WordPress plug-in maker called Essential Plugin. Ginder said someone last year bought Essential Plugin and the backdoor was soon added to the plug-ins’ source code. The backdoor sat dormant until earlier this month when it activated and began distributing malicious code to any website with the plug-ins installed. ....
Thanked by 1Ympker
Comments
Nothing new
WordPress is a backdoor
And water is wet.
lol fork found in kitchen
Good news, you can just switch to CF's vibe-coded WordPress replacement.
Legitimate question: what's the alternative?
Sure I can use insert_name_here but that's also means writing a bunch plug-ins to support shipping services, banks, weird local addresses. Plus, keeping them updated. Or I can use WP and spend time to beef up security instead. Neither option is cheap for a small company!
No, local 3rd party services don't play nice with eachother so I would have to pay for multiple services and have data fragmented any how!?
No alternatives. Clean malware and continue like nothing happened.
FYI, here's the list of the evil plugins (from the original site):
Hth.
Yes but I saw a wordpress fork named classicpress, they have removed many legacy componenets but have kept some too !! I guess maybe its an alternative people can look into.
The pope is catholic
People can, but business - not. These malware incidents keeps giving some gigs for people, something bright in gloomy day.
Try to penetrate my backdoor and see what happens....
I would not even think of trying. I would rather ask nicely and wait to be invited through the front door. Civilisation and good manners are built on mutual respect. A website is much more beautiful when one checks, reads and understands the actual content and its author, instead of bypassing everything looking for backdoors like some abuser with a (caveman club) artificial intelligence in his hands.
Good time all around?
Vibe coded wordpress from another world !
Just tried "deploying" it. Requires me to spend $5/mo lol
lol don't https://news.ycombinator.com/item?id=47602832