Researchers: 40 themes and 53 plugins for WordPress downloaded from AccessPress had backdoors dating back to September, giving attackers full admin control
A massive supply chain attack compromised 93 WordPress themes and plugins to contain a backdoor, giving threat-actors full access to websites.
Context & Ripple Effects
AccessPress is a commercial theme-and-plugin vendor whose catalog was compromised at the source: researchers found backdoors in 40 themes and 53 plugins shipped from its own downloads, meaning customers who installed legitimate copies were infected. The disclosure lands nine days after researchers tallied a record 2,240 third-party WordPress plugin vulnerabilities disclosed in 2021, up 142% year over year.
The pattern is not new for the ecosystem — back in 2019 attackers were planting backdoor admin accounts through a popular plugin's zero-day — but compromising the vendor's distribution channel rather than a single plugin's code marks an escalation. The same playbook resurfaces two years later in a yearlong supply-chain campaign that harvested more than 390K WordPress credentials.
First-order effects
- Every site running an affected AccessPress download has had a hidden administrator-level foothold since September, so owners must assume full compromise — remove the backdoor, rotate all credentials, and audit for persistence rather than just updating the theme or plugin.
- AccessPress must reissue clean versions of its entire catalog and rebuild customer trust, while hosting providers and security firms race to add detections for the injected code.
Second-order effects
- Buyers of commercial WordPress products gain a new due-diligence burden — verifying vendor integrity, not just feature fit — which pressures smaller theme shops to prove their build pipelines are secure or lose sales to vendors who can.
- Security scanners and managed-hosting providers see demand for supply-chain-aware detection rise, since signature-based plugin vulnerability scanning would not have caught code poisoned upstream at the vendor.
Third-order effects
- If vendor-channel compromises keep recurring alongside the volume of plugin flaws, the WordPress ecosystem drifts toward curated, attested distribution — platform-run or sandboxed environments such as browser-isolated workspaces — at the expense of the open free-for-all marketplace model.
- Regulators and enterprise buyers increasingly treat WordPress supply-chain incidents as a category, pushing theme and plugin vendors toward verifiable build provenance as a condition of doing business.
The trend: Attacks on the WordPress ecosystem are shifting from exploiting individual vulnerable plugins to poisoning trusted vendors' distribution channels, making software supply-chain integrity the ecosystem's defining security problem.