US-based cybersecurity company publicly discloses two zero-days in two of Facebook's official WordPress plugins, one with 200K users and one with 20K+ users
Context & Ripple Effects
This lands mid-spiral in 2019's WordPress disclosure wars. Weeks earlier, a researcher publicly dropped 0-day flaws in WordPress plugins before any patch existed to protest forum moderators, and in March hacker groups were already exploiting a plugin zero-day to plant backdoor admin accounts and redirect visitors to tech support scams. Now a US cybersecurity firm is applying the same disclose-first playbook to plugins carrying Facebook's own brand.
The stakes are concrete: one affected plugin has roughly 200K users, the other 20K+, meaning hundreds of thousands of sites are running code with known, unpatched holes published under a corporate name that implies maintenance.
First-order effects
- Site administrators running either plugin face an immediate choice between deactivating functionality or staying exposed, since no vendor patch exists at disclosure time.
- Facebook's plugin team is put on the clock to ship fixes for both plugins, with its brand attached to vulnerabilities now documented publicly.
Second-order effects
- Attackers monitoring disclosures can weaponize these flaws the way the March campaign did — backdoor accounts and scam redirects are the proven monetization path for abandoned or vulnerable WordPress plugins.
- Other companies shipping official WordPress integrations face pressure to demonstrate active maintenance and a patch SLA, or risk their own plugins being framed as liability rather than reach.
Third-order effects
- If disclose-before-patch becomes normalized after the April protest and this release, coordinated vulnerability disclosure erodes across the WordPress plugin ecosystem, shifting security burden onto end users who must audit and drop plugins themselves.
- The pattern reinforces WordPress's structural weakness: its third-party plugin supply chain, not core, is where mass-site compromise happens — a dynamic still visible years later when hackers kept exploiting vulnerable WordPress installs even after WordPress patched two critical core flaws.
The trend: WordPress security is shifting from vendor-coordinated patching toward public zero-day disclosure as leverage, leaving the plugin supply chain — including big-brand official plugins — as the web's most exposed attack surface.