Published: · Region: Global · Category: cyber

WordPress Supply‑Chain Backdoor Puts Thousands of Sites and Users at Silent Risk

Attackers gained write access to data used by seven popular BdThemes WordPress plugins, poisoning JSON files to create rogue admin accounts and web shells on sites that installed updates. The compromise shows how a quiet supply‑chain breach in a single plugin vendor can cascade across thousands of websites and the users who trust them.

A stealthy hack on a cluster of popular WordPress plugins has turned routine updates into a vehicle for website takeovers, underscoring how vulnerable the internet’s software supply chain remains even for widely used tools. Security researchers have disclosed that seven plugins developed by BdThemes were effectively weaponized after attackers obtained write access to vendor‑hosted data fetched inside WordPress admin panels. By poisoning JSON configuration files that the plugins relied on, the intruders were able to inject backdoors into sites that used the affected add‑ons, creating unauthorized administrator accounts and planting web shells for remote control. The compromised plugins have since been disabled, but not before code shipped out through legitimate…

Pro features include

  • 60+ analytical tools across markets and intelligence
  • Custom alerts, watchlists, and AOI monitoring
  • Daily Pro brief at 6 PM ET — 12 hours before free tier
  • Conflict deep dives and premium research products

Related Coverage

GLOBAL

WordPress Supply-Chain Attack Turns Popular Plugins Into Rogue Admin Backdoors

Attackers gained write access to data used by seven BdThemes WordPress plugins, poisoning JSON feeds to silently create rogue admin accounts and web shells on vulnerable sites. The incident turns a routine plugin update path into a supply‑chain breach with consequences for website owners, hosting providers and any business relying on WordPress for critical services.
GLOBAL

WordPress Supply-Chain Attack Lets Hackers Create Rogue Admins, Putting Millions of Sites at Risk

Attackers abused updates to seven popular BdThemes plugins to poison JSON data and silently create rogue admin accounts and web shells on WordPress sites, prompting the plugins’ suspension. For businesses, media outlets and governments running on WordPress, the breach turns a routine update channel into a potential backdoor, with implications from espionage to ransomware.
GLOBAL

Secret Plane Swap After Iranian Threat Exposes How Far Washington Will Go to Shield Trump Abroad

U.S. media have revealed that after an Iranian assassination threat, Donald Trump was quietly moved from the new Qatar‑gifted 747‑8 to a different U.S. military aircraft after the NATO summit in Ankara, despite publicly boarding the older Air Force One on camera. The covert swap, and a separate F‑16 interception over his Bedminster golf course, show how security for a former president under active threat is reshaping routines at home and abroad.
WARNING

US Pours $17.5 Billion Into New Nuclear Reactors, Rewiring Power and Fuel Outlook

At 07:00 UTC, Washington committed $17.5 billion to build new nuclear reactors, a scale of support that can reshape the U.S. power mix, long‑term demand for uranium, and capital flows in the energy sector. The move bolsters grid reliability and decarbonization goals but also redraws the competitive map for gas, coal, renewables, and industrial users exposed to U.S. electricity prices.
WARNING

Hackers Hit Polish CHP Turbine, Expose New Grid Vulnerability

Hackers shut down a turbine at a Polish combined heat and power plant by pivoting through a private cellular network into the plant’s OT systems, marking the first such incident seen by CERT via this APN route. While the direct physical impact is small, the demonstration of a new attack vector into European generation assets adds a modest risk premium to regional power and gas markets.
WARNING

New Libya Oil Tank Hit Adds to Export Disruption Risk

A previously unclaimed drone strike has hit an oil storage tank in Zawiya, Libya, following an earlier reported attack on a Libyan oil tank. The incident heightens immediate disruption and escalation risk around western Libyan export infrastructure, adding upside pressure to crude benchmarks via supply risk premium.