WordPress Plugins
WordPress Plugins and Themes
Add-ons from the WordPress.org directory and vendors, with full control of the site.
About
Plugins and themes add features to a WordPress site, from contact forms to whole shops. Most come from the WordPress.org directory, others straight from vendors' own sites. Each one runs as part of WordPress, with full access to the site and its database.
An active plugin runs on every page load, with full access to the site, its files and its database. Updates can install themselves automatically.
If It Is Malicious
If a WordPress plugin is malicious, it runs inside WordPress with full control of the site and its database, on every site that installs or auto-updates it.
Its code runs inside these technologies.
Examples
These are well-known names from WordPress Plugins, written as you would meet them in an inventory, an alert or a lockfile, the file that records every version a build installed.
woocommerce- Turns a WordPress site into an online shop.
wordpress-seo- Yoast SEO, for search engine settings.
contact-form-7- One of the oldest and most installed form plugins.
elementor- A visual page builder.
akismet- Spam filtering, bundled with WordPress.
How Bad Code Gets In
These are the ways bad code can reach your systems through WordPress Plugins. None of them needs a flaw in your own code, so outside code needs checking as much as your own.
- A plugin developer's account is taken over and a bad update is pushed to every site.
- A plugin is sold to a new owner who adds spam or a backdoor.
- A vendor's own download site is hacked, so its files carry a backdoor.
- A flaw in a popular plugin can be exploited on every site that has not updated.
How to Check
These checks show what came from WordPress Plugins, whether a known bad version is in use, and how to keep one out next time.
- Keep a list of installed plugins and versions, and remove the ones you do not use.
- Check them against the Wordfence Intelligence or WPScan vulnerability databases.
- Install only from the WordPress.org directory or the vendor you pay, never from copies elsewhere.
- Turn on automatic updates for security fixes, and look for new admin accounts after an update.
Well-Known Incidents
Each incident below is a real case, told at the level of its public advisory. The tag says how the bad code got in, and the link opens the primary source.
Compromised Build or ReleaseCVE-2021-248672022
AccessPress Backdoor
Attackers broke into a theme vendor's website and added a backdoor to the themes and plugins it offered for download there.
Reach Sites that installed or updated those products from the vendor's own site gave the attacker full control of the site.
Source: jetpack.com (opens in a new tab)Hijacked Account2024
WordPress.org Plugin Takeovers
Attackers got into five plugin developers' WordPress.org accounts, likely with passwords leaked elsewhere, and pushed updates that tried to create a new administrator account on each site.
Reach The code sent the new account's details to the attacker, so any site that took the updates had to be treated as compromised.
Affected
Source: wordfence.com (opens in a new tab)social-warfareblaze-widgetwrapper-link-elementorcontact-form-7-multi-step-addonsimply-show-hooks
In Common Stacks
These common stacks take code from WordPress Plugins. Open one to see where that code sits among its layers and who runs each one.