Loading story…
WordPress.org has begun automatically reviewing every plugin and theme release before it is distributed through the WordPress.org update API, blocking releases that exceed its security-risk threshold. The system combines multiple AI models with Jetpack Scan to assess code changes during a mandatory six-hour cooldown period and cross-check findings into a consolidated risk score.
The controls prevented a backdoored update for a plugin with roughly 20,000 active installations from reaching users after the malicious commit was detected on July 28. Developers of blocked releases receive findings by email and must publish a remediated version or request Plugins Team review if they believe the detection was a false positive.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
A malicious commit added a backdoor to a release for a plugin with about 20,000 active installations. The automated review assigned it a high-risk score during the cooldown, preventing distribution through the WordPress.org update API; the Plugins Team removed the plugin from the directory 26 minutes after a Wordfence alert.
WordPress.org instituted a mandatory six-hour cooldown for every plugin and theme release, withholding releases from the update API while they undergo security assessment.
WordPress.org began applying automated AI-model and Jetpack Scan review to plugin and theme releases before update-API distribution. Releases exceeding its risk threshold are automatically blocked, and committers receive findings to remediate or contest through manual review.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcehelpnetsecurity.com
Open sourcemake.wordpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026
A supply-chain compromise of ShapedPlugin’s premium WordPress plugin distribution inserted backdoor code into official paid releases, allowing unauthenticated attackers to fully compromise affected websites. Wordfence said the attackers tampered with the vendor’s update pipeline used for Pro builds distributed via Easy Digital Downloads, while free versions in the WordPress repository were not affected. Confirmed malicious releases included **Smart Post Show Pro** `4.0.1`, **Product Slider for WooCommerce Pro** `3.5.2`, and **Real Testimonials Pro** `3.2.4`, which were later replaced by clean versions `4.0.2`, `3.5.3`, and `3.2.5`; the incident is tracked as **`CVE-2026-10735`** with a reported **CVSS 9.8**.
Jun 29, 2026
Attackers targeted multiple widely used WordPress plugins with critical flaws that enabled site takeover, malware deployment, and remote code execution. The most prominent issue, `CVE-2024-27956` in **WP-Automatic** before version `3.9.2.0`, was exploited through SQL injection to bypass authentication, create rogue administrator accounts, upload malicious files, and fully compromise websites; defenders were told to watch for suspicious admin usernames beginning with `xtw`, renamed WP-Automatic files, and known malicious file hashes. CSIRT.SK also reported more than **5.5 million** exploitation attempts across several WordPress plugin vulnerabilities, including `CVE-2024-27956`, `CVE-2024-2876`, `CVE-2024-2417`, and `CVE-2024-28890`. Separate advisories warned that **Forminator** versions earlier than `1.29.3` contained a critical unrestricted file upload flaw, `CVE-2024-28890`, that could let remote attackers execute code on the server, alongside `CVE-2024-31077` and `CVE-2024-31857`, which exposed sites to SQL injection and cross-site scripting. CSIRT.SK also flagged **Poll Maker** before version `3.4` for `CVE-2024-32514`, an arbitrary file upload vulnerability that could lead to remote code execution. The combined disclosures showed active attacker focus on vulnerable WordPress plugins as an initial access path, prompting urgent patching and compromise checks across exposed sites.
Jul 24, 2026