Hacker groups are creating backdoor admin accounts and redirecting users to tech support scams using a zero-day vulnerability in a popular WordPress plugin
Context & Ripple Effects
This report lands in the middle of a recurring pattern in the WordPress plugin ecosystem: third-party code becoming the preferred entry point rather than core itself. Weeks after this story, a researcher publicly disclosed unpatched plugin flaws in protest of forum moderation, and months later two zero-days surfaced in Facebook's official plugins — both showing that even high-profile plugin authors were not keeping pace with attackers.
The technique reported here — persistent backdoor admin accounts plus traffic redirection to tech support scams — foreshadowed what researchers later found at supply-chain scale, when 40 themes and 53 plugins from a single vendor were discovered with backdoors giving full admin control.
First-order effects
- Site owners running the affected plugin face immediate compromise: attackers hold hidden admin credentials that survive password resets, while their visitors are silently routed to tech support scam pages.
- The plugin's developer is forced into an emergency patch-and-disclose cycle, and every installation that does not update promptly remains an open door.
Second-order effects
- WordPress administrators respond by auditing user tables and tightening plugin vetting, shifting trust away from popularity metrics toward vendors' patch discipline — the same scrutiny that later exposed the widespread AccessPress theme and plugin backdoors.
- Security firms gain a recurring remediation market around compromised WordPress sites, and plugin developers face competitive pressure as buyers weigh maintenance quality, a dynamic visible when zero-days hit even Facebook's official plugins (two disclosed in its WordPress plugins).
Third-order effects
- If plugin-level compromises keep recurring, the ecosystem structurally migrates toward fewer, better-governed extension sources and hosted or sandboxed environments — the direction WordPress itself moved with its browser-based private workspaces — shrinking the open plugin surface that made this attack possible.
- Disclosure norms harden: the episode sits between a researcher's pre-patch public disclosure of plugin flaws and coordinated vendor fixes, pushing the community toward standardized responsible-disclosure timelines for third-party code.
The trend: WordPress attacks are migrating from core software to the third-party plugin and theme supply chain, pushing the ecosystem toward curated distribution and managed environments.