Millions of WordPress Sites Just Got Hacked... Again

Millions of WordPress Sites Just Got Hacked... Again ![rw-book-cover](https://img.youtube.com/vi/piah4fV_o2Q/maxresdefault.jpg) 🔗 **Source:** [Millions of WordPress Sites Just Got Hacked... Again](https://www.youtube.com/watch?v=piah4fV_o2Q) > [!note]+ Document Notes > tags: #wordpress #cybersecurity #supply-chain-attack #plugins #malware > author: Fireship > source: YouTube > reference: https://www.youtube.com/watch?v=piah4fV_o2Q&t=4s > date created: 2024-12-28 18:30 > > # 🏷️ Title: Millions of WordPress sites just got hacked... again >  ## 🧰 Action Inbox - [H1] Audit WordPress plugin acquisition and update processes — supply chain attack via legitimate plugin purchase #cybersecurity - [H2] Evaluate plugin sandboxing alternatives like Cloudflare's Mdash — full privilege escalation risks #wordpress - [H3] Implement plugin manifest and capability-based security model — sandbox isolation missing #security ## 🧭 Table of Contents - [[#📝 Summary]] - [[#📖 Main Content]] - [[#🗒️ Notes]] - [[#📚 References]] - [[#🗣️ Paraphrase]] - [[#📰 Newsletter]] - [[#✅ Action Items]] - [[#🧪 Hypotheses]] - [[#📊 Methodology]] - [[#❓ Questions]] - [[#🔮 Future Research]] - [[#💡 Implications]] - [[#🧠 Learning Styles Assessment]] - [[#📊 Accessibility Assessment]] - [[#🌍 DEIB Assessment]] - [[#✅ Logical Validity]] - [[#🛡️ DARVO Analysis]] - [[#🎯 Conclusion]] ### 🔗 References - [WordPress Plugin Directory](https://wordpress.org/plugins/) - [Cloudflare Mdash Project](https://github.com/cloudflare/mdash) ## 📝 Summary - What happened: Supply chain attack compromised 31 WordPress plugins through legitimate acquisition, affecting millions of sites with dormant backdoors activated 8 months later - Why it matters: Attack bypassed normal security measures by using trusted plugin update mechanism, highlighting fundamental architectural vulnerabilities in WordPress plugin system - Key stakeholders: WordPress site owners, plugin developers, hosting providers, cybersecurity teams - Risks and tradeoffs: Plugin ecosystem provides functionality but creates massive attack surface with full system privileges and no sandboxing - Bottom line: WordPress plugin architecture remains fundamentally insecure; new solutions like Cloudflare's Mdash attempt sandboxed alternatives but adoption uncertain ## 📖 Main Content This incident represents a sophisticated supply chain attack where attackers legitimately purchased a portfolio of WordPress plugins on Flippa marketplace for an estimated mid-six-figure sum. Rather than exploiting code vulnerabilities, they acquired legitimate ownership and inserted backdoors that remained dormant for 8 months before activation. The attack methodology involved purchasing established plugins, inserting malicious code during the ownership transition, and waiting for optimal timing to activate the payload. When triggered, the malware contacted remote command-and-control servers via Ethereum smart contracts, downloaded additional payloads, and modified core WordPress files including wp-config.php containing database credentials and security keys. This attack succeeded because it leveraged the trusted plugin update mechanism, bypassing typical security suspicions around phishing or unauthorized modifications. WordPress's plugin architecture allows plugins full system access without sandboxing or capability restrictions, creating significant security exposure. Cloudflare's Mdash project attempts to address these architectural issues by creating a WordPress-compatible framework with plugin sandboxing, capability-based permissions, and worker isolation. However, widespread adoption faces significant ecosystem inertia challenges. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/piah4fV_o2Q?t=0) — [H1] Massive WordPress plugin supply chain attack discovered - Key idea: Attackers compromised 31 plugins through legitimate acquisition, remaining undetected for 8 months - Evidence: "Eight months ago, some galaxyrained hacker quietly penetrated the back door of more than 30 WordPress plugins" #### ⏱️ [00:30](https://youtu.be/piah4fV_o2Q?t=30) — [H2] WordPress plugin architecture fundamentally insecure - Key idea: Plugin system provides no sandboxing or isolation, running with full system privileges - Evidence: "WordPress's plug-in architecture is fundamentally insecure" #### ⏱️ [01:15](https://youtu.be/piah4fV_o2Q?t=75) — [H3] WordPress ecosystem context and recent conflicts - Key idea: Platform experiencing broader governance and legal challenges affecting security focus - Evidence: "WordPress ecosystem has experienced a wild couple of years" #### ⏱️ [02:30](https://youtu.be/piah4fV_o2Q?t=150) — [H1] 96% of WordPress vulnerabilities stem from plugins - Key idea: Plugin system represents overwhelming majority of WordPress security issues - Evidence: "96% of those are a direct result of its plug-in system" #### ⏱️ [02:45](https://youtu.be/piah4fV_o2Q?t=165) — [H1] Plugins run with unrestricted system access - Key idea: WordPress plugins operate as PHP scripts with full database and file system privileges - Evidence: "WordPress plug-in is basically just a PHP script that plugs straight into your site and starts running with full privileges" #### ⏱️ [03:15](https://youtu.be/piah4fV_o2Q?t=195) — [H1] Attack vector was legitimate plugin acquisition, not code exploitation - Key idea: Attackers purchased plugins legally rather than exploiting vulnerabilities - Evidence: "They legitimately acquired and took control of a portfolio of plugins by simply purchasing them for money" #### ⏱️ [04:00](https://youtu.be/piah4fV_o2Q?t=240) — [H2] Backdoor insertion during ownership transition - Key idea: Malicious code inserted after legitimate purchase, remaining dormant for months - Evidence: "New buyer had control of the code and they inserted a back door about 8 months ago" #### ⏱️ [04:30](https://youtu.be/piah4fV_o2Q?t=270) — [H1] Attack targeted core WordPress configuration files - Key idea: Malware modified wp-config.php containing sensitive database and security credentials - Evidence: "Modified core files like wpconfig.php which includes sensitive data like your database connection and security keys" #### ⏱️ [04:45](https://youtu.be/piah4fV_o2Q?t=285) — [H2] Ethereum smart contracts used for command and control - Key idea: Attackers used blockchain technology for resilient infrastructure management - Evidence: "Command and control domain was resolved through an Ethereum smart contract" #### ⏱️ [05:15](https://youtu.be/piah4fV_o2Q?t=315) — [H1] Trusted update mechanism bypassed security suspicions - Key idea: Attack succeeded by using legitimate plugin update channels rather than suspicious methods - Evidence: "Everything was delivered through a normal plug-in update from a trusted source" #### ⏱️ [06:00](https://youtu.be/piah4fV_o2Q?t=360) — [H2] Cloudflare's Mdash provides WordPress alternative with sandboxing - Key idea: New MIT-licensed project offers WordPress API compatibility with plugin security isolation - Evidence: "Cloudflare recently created a new project called Mdash, which takes all that old crappy PHP code" #### ⏱️ [06:45](https://youtu.be/piah4fV_o2Q?t=405) — [H2] Mdash implements capability-based plugin security model - Key idea: Plugins only receive specific permissions through explicit manifest declarations - Evidence: "Plug-in only gets access to specific capabilities through bindings and only if it explicitly asks for them" #### ⏱️ [07:15](https://youtu.be/piah4fV_o2Q?t=435) — [H3] WordPress replacement unlikely despite security improvements - Key idea: Ecosystem inertia makes WordPress displacement improbable in near term - Evidence: "Will mdash actually kill WordPress once and for all? The answer is probably not" ## 📚 References - [WordPress Plugin Security Guidelines](https://developer.wordpress.org/plugins/security/) - [Cloudflare Mdash GitHub Repository](https://github.com/cloudflare/mdash) - [WordPress Security Vulnerability Database](https://wpscan.com/) ## 🗣️ Paraphrase - Attackers compromised millions of WordPress sites by legitimately purchasing plugins and inserting backdoors that activated months later through trusted update mechanisms - WordPress's plugin architecture creates massive security exposure by granting plugins unrestricted system access without sandboxing or capability restrictions - Cloudflare's Mdash project attempts to solve these issues with a WordPress-compatible framework featuring plugin sandboxing and permission-based security, though widespread adoption remains uncertain ## 📰 Newsletter WordPress users face a sobering security reality: a recent supply chain attack compromised 31 plugins by legitimately purchasing them and inserting backdoors. Unlike typical exploits, this attack succeeded through the trusted plugin update system, highlighting fundamental architectural vulnerabilities. The core issue is WordPress's plugin system grants unrestricted access to your database, files, and server - essentially handing strangers the keys to your digital kingdom. With 96% of WordPress vulnerabilities originating from plugins, this represents a massive ongoing risk. Cloudflare's new Mdash project offers hope with WordPress API compatibility plus plugin sandboxing and capability-based permissions. While promising, ecosystem adoption remains uncertain given WordPress's entrenched market position. Immediate action items: audit your plugin sources, implement security monitoring, and consider plugin alternatives where possible. Resources: [Learn WordPress Security](https://learn.wordpress.org/), [Plugin Security Handbook](https://developer.wordpress.org/plugins/security/), [WP-CLI Security Commands](https://wp-cli.org/) ## ✅ Action Items #### WordPress - Core: Implement plugin capability system and sandboxing architecture - Core Performance: Analyze security overhead of plugin isolation mechanisms - Core Program Team: Coordinate plugin security working group formation - Community: Develop plugin security best practices documentation - Training: Create plugin security assessment curricula - Support: Establish plugin security incident response procedures - Documentation: Plugin security guidelines and threat modeling - Plugins: Implement security review processes and automated scanning - Meta: .org plugin directory security verification requirements #### OSPO - Policy & Governance: Plugin acquisition due diligence frameworks - License Compliance: Third-party plugin license verification - Security Management: Supply chain attack detection and response - Software Inventory: Plugin dependency tracking and SBOM generation - Developer Support: Secure plugin development training programs - Strategic Alignment: Plugin security metrics and KPI development #### Community - Maintainers: Plugin security audit templates and checklists - Contributors: Security-focused plugin review processes - Sponsors: Funding for plugin security research and tooling - Ecosystem: Cross-plugin security coordination protocols ## 🧪 Hypotheses - Plugin sandboxing implementation will reduce WordPress vulnerabilities by 80% within 24 months - Supply chain attacks on popular CMS plugins will increase 300% as traditional exploit methods become harder - Capability-based plugin security models will become standard across major CMS platforms by 2027 - WordPress market share will decline 15% within 3 years due to unresolved security architecture issues ### 📊 Methodology - Longitudinal study tracking WordPress vulnerability reports pre/post sandboxing implementation - Comparative analysis of supply chain attacks across different CMS ecosystems and security models - Survey research on developer adoption barriers for secure plugin development frameworks ### ❓ Questions - Can WordPress implement plugin sandboxing without breaking backward compatibility with existing plugins? - What economic incentives would drive faster adoption of secure plugin architectures? - How can plugin marketplaces implement better due diligence for ownership transfers? ### 🔮 Future Research - Analysis of blockchain-based command and control resilience in cybersecurity contexts - Comparative security assessment of different CMS plugin architecture models - Economic impact study of supply chain attacks on small business WordPress sites ### 💡 Implications - Practice: WordPress developers must implement additional security layers and monitoring for plugin-based sites - Policy: Plugin marketplaces need ownership transfer verification and security review requirements - Security: Traditional vulnerability scanning insufficient for supply chain attacks via legitimate channels - Education: WordPress training must emphasize plugin security risks and mitigation strategies - Funding: Investment needed for plugin security research, tooling, and alternative architecture development ### 🧠 Learning Styles Assessment Reading level estimate: 10th Grade (Flesch-Kincaid) #### 👀 Visual learners - Present: Code examples, system architecture descriptions - Improve: Plugin architecture diagrams, attack flow visualizations, security model comparisons #### 🔊 Aural learners - Present: Video format with narration and explanations - Improve: Podcast-style security analysis, audio summaries of key concepts #### 🗣️ Verbal learners - Present: Clear definitions of technical terms, analogies like "no square" reference - Improve: More security analogies, glossary of cybersecurity terms #### 🧩 Kinesthetic learners - Present: Code examples and practical attack scenarios - Improve: Plugin security audit checklists, hands-on security testing labs #### 🧠 Logical learners - Present: Statistical data (96% of vulnerabilities), timeline of events - Improve: Decision trees for plugin selection, risk assessment matrices #### 🧑‍🤝‍🧑 Social learners - Present: Discussion of community impact and developer perspectives - Improve: Security community forums, collaborative threat analysis #### 🧘‍♀️ Solitary learners - Present: Individual analysis of security implications - Improve: Self-assessment security questionnaires, personal security audit guides #### 🌿 Naturalistic learners - Present: Ecosystem metaphors for plugin relationships - Improve: Security ecology analogies, environmental impact of cyber attacks ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Good heading structure, descriptive video content - Improve: Alt text for technical diagrams, ARIA labels for code examples #### Keyboard navigation - Present: Standard video controls accessible via keyboard - Improve: Transcript navigation, keyboard shortcuts for technical content #### Contrast and readability - Present: High contrast video interface, clear narration - Improve: Transcript formatting, technical term highlighting #### Text resizing and reflow - Present: Video scales appropriately across devices - Improve: Responsive transcript layout, adjustable text sizing #### Media and captions - Present: Full video transcript provided - Improve: Time-synced captions, downloadable transcript formats #### Forms and interactions - Present: Standard video player interactions - Improve: Interactive security assessment forms, accessible feedback mechanisms ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global perspective on WordPress usage and security impacts - Improve: Multi-regional case studies, international plugin security examples #### Inclusive language - Present: Generally accessible technical explanations - Improve: Define more cybersecurity jargon, avoid cultural idioms #### Neurodiversity support - Present: Clear section breaks, consistent information structure - Improve: Content warnings for security concerns, summary boxes #### Representation - Present: Focus on technical content rather than personal examples - Improve: Diverse developer perspectives, inclusive security examples #### Psychological safety - Present: Factual reporting without blame or shaming - Improve: Supportive guidance for affected users, non-judgmental security advice ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Valid logical progression from plugin architecture to security vulnerabilities - Inductive strength: Strong evidence pattern from 96% vulnerability statistic to architectural conclusions - Causal reasoning: Clear cause-effect relationship between plugin privileges and attack success - Analogical strength: Effective security analogies help explain complex technical concepts #### Fallacies - Hasty generalization: Concluding all WordPress is insecure based on plugin vulnerabilities - overgeneralization - Appeal to novelty: Suggesting Mdash is better primarily because it's newer - needs more comparative evidence #### Tone of voice - Overall tone: Informative and entertaining with technical humor, maintaining accessibility while covering serious security topics ### 🛡️ DARVO Analysis - Deny: No denial patterns present - straightforward reporting of security incident - Attack: No attacks on accusers - factual analysis of technical vulnerabilities - Reverse victim/offender: No victim/offender reversal - clear identification of attackers and victims - Emotional cues and rhetoric: Uses humor and casual language to make serious security topics accessible without minimizing risks ## 🎯 Conclusion This supply chain attack represents a sophisticated evolution in WordPress security threats, moving beyond traditional vulnerability exploitation to legitimate ownership acquisition. The fundamental issue remains WordPress's plugin architecture, which grants unrestricted system access without sandboxing or capability controls. While solutions like Cloudflare's Mdash offer promising alternatives with plugin sandboxing and permission-based security models, widespread --- ## Full Transcript [00:00] Eight months ago, some galaxyrained [00:02] hacker quietly penetrated the back door [00:04] of more than 30 WordPress plugins, and [00:06] no one noticed until now. Somehow, this [00:09] massive collection of different [00:10] WordPress plugins for silly UI updates [00:13] was instantly turned into malware with a [00:15] crazy supply chain attack. That means [00:17] one minute your countdown timer ultimate [00:19] plugin is converting sales on your [00:21] website, then the next minute it becomes [00:22] a remote control demon on your server [00:24] that steals all your data and leaks [00:26] photos of your wife's boyfriend to the [00:28] Kiwi Farms. WordPress remains the most [00:30] popular website builder in the world, [00:32] but many people have argued that [00:33] WordPress's plug-in architecture is [00:35] fundamentally insecure and a brand new [00:38] slot fork has emerged to replace it. In [00:40] today's video, we'll find out how the [00:41] latest brutal exploit occurred and take [00:43] a look at this new project from [00:44] Cloudflare that hopes to terminate [00:46] WordPress from the timeline. It is April [00:48] 16th, 2026, and you're watching the code [00:51] report. I actually love WordPress and [00:53] have built many failed side projects [00:54] with it, but the WordPress ecosystem has [00:56] experienced a wild couple of years. Its [00:58] founder, Matt Mullenweg, spurred out on [01:01] private equity last year because the [01:02] Silver Lake owned WP Engine was drinking [01:05] his milkshake by making money hosting [01:07] WordPress. So, naturally, he demanded [01:09] that they pay him 8% of their revenue [01:11] for using his logo. Now, as you all [01:13] know, I'm a huge fan of private equity [01:14] because they make every product better, [01:16] like Hooters, for example. But WP Engine [01:19] refused to pay the king as royalty. that [01:20] made Mullenweg spur out even harder and [01:22] he said a bunch of stuff that eventually [01:24] led to WP Engine filing a defamation [01:26] lawsuit against him. They're still [01:28] fighting each other in court to this day [01:29] and the lore goes way deeper. But the [01:31] bigger problem for WordPress is that [01:33] it's been experiencing a wave of new [01:35] vulnerabilities and 96% of those are a [01:37] direct result of its plug-in system. The [01:39] core problem is that a WordPress plug-in [01:41] is basically just a PHP script that [01:43] plugs straight into your site and starts [01:45] running with full privileges. There's no [01:47] sandbox or isolation. It can touch your [01:49] database, your files, and your private [01:51] parts. And when you install a plugin, [01:53] you're basically just hoping a stranger [01:54] knows how to handle every edge case, [01:56] exploit, and bad input perfectly. What's [01:58] crazy, though, is that this most recent [02:00] attack on 31 WordPress plugins was [02:03] actually not the result of bad code. [02:05] >> It's not your fault. [02:06] >> It was something far scarier. In this [02:08] case, the attacker didn't exploit a [02:10] vulnerability. Instead, they [02:11] legitimately acquired and took control [02:13] of a portfolio of plugins by simply [02:16] purchasing them for money from the [02:17] original developer on Flippa in a deal [02:20] with the sales price estimated to be in [02:21] the mid6 figures. After the original [02:23] developer was bought out, the new buyer [02:25] had control of the code and they [02:27] inserted a back door about 8 months ago [02:29] and it's just been sitting there dormant [02:30] in production waiting for the right [02:32] moment. Then when the moment was right, [02:34] the malicious logic activated which [02:36] reached out to a remote server, pulled [02:38] down additional payloads and in some [02:39] cases modified core files like [02:42] wpconfig.php [02:44] which includes sensitive data like your [02:45] database connection and security keys. [02:47] And apparently the command and control [02:49] domain was resolved through an Ethereum [02:51] smart contract. So once the exploit [02:53] became known, the attacker could quickly [02:55] update the smart contract to point to a [02:57] new domain at any time. That's pretty [02:59] clever. But the core issue here is that [03:01] everything was delivered through a [03:02] normal plug-in update from a trusted [03:04] source. And so it bypassed the usual [03:06] suspicion of a normal fishing attack. [03:08] And now WordPress did step in and remove [03:10] the plugins. But damage was already done [03:12] inside the system. It turning what [03:13] looked like routine maintenance into a [03:15] full-blown supply chain compromise. [03:17] Luckily though, if you're considering [03:18] using WordPress today, Cloudflare [03:20] recently created a new project called [03:22] Mdash, which takes all that old crappy [03:24] PHP code and turns it into something [03:26] even crappier, AI written JavaScript [03:29] code. This project actually doesn't use [03:31] any original WordPress code and is MIT [03:33] licensed, but it's designed to be fully [03:35] compatible with the original WordPress [03:37] APIs. And under the hood, it's based on [03:39] the awesome Astro project for its [03:41] content management system. What makes [03:43] this project special though is that it [03:45] doesn't let plugins run wild with full [03:47] access. Mdash locks each plugin down in [03:49] its own sandbox with a dynamic worker. [03:52] The framework itself doesn't hand over [03:54] your data directly. Instead, the plug-in [03:56] only gets access to specific [03:58] capabilities through bindings and only [04:00] if it explicitly asks for them in the [04:01] manifest. It's kind of like telling the [04:03] plugin, "No, no, don't touch me there. [04:05] This is my no square." Pretty cool, but [04:08] will mdash actually kill WordPress once [04:10] and for all? The answer is probably not. [04:12] and definitely not anytime soon. But the [04:14] craziest thing to me is how quickly [04:16] developers can roll out complete [04:18] replacements for frameworks that have [04:19] been around forever. And that's made [04:21] possible by modern AI coding tools like [04:23] Warp, the sponsor of today's video. If [04:25] you're viaxing with Claude Code, Codeex, [04:28] Gemini CLI, and Open Code at the same [04:30] time, but keep losing track of all your [04:32] agents, you need to check out Warp's new [04:34] universal agent support, which turns [04:36] your terminal into an agent command [04:38] center. Vertical tabs let you group your [04:40] agent sessions together and quickly see [04:42] useful metadata like get branch, work [04:44] tree, and pull request status, which [04:46] means your terminal finally has object [04:48] permanence. And the tab configs let you [04:50] save your ideal setup and reopen it [04:52] instantly in the future. The best part [04:54] though is that you can get notifications [04:56] from your coding agents in Warp and on [04:58] your desktop whenever they need [04:59] attention instead of checking on them [05:01] every 30 seconds like a helicopter [05:03] parent. So, if you already have an agent [05:05] you like or you want to try running [05:06] multiple agents at once, I'd highly [05:08] recommend checking out Warp for free at [05:10] the link below. But this has been the [05:11] Code Report. Thanks for watching and I [05:13] will see you in the next one.  📄 **Full text:** ![[Full Document Contents/Articles/Millions of WordPress Sites Just Got Hacked... Again.md|Millions of WordPress Sites Just Got Hacked... Again by YouTube]] ## Highlights - Eight months ago, some galaxyrained hacker quietly penetrated the back door of more than 30 WordPress plugins, and no one noticed until now. Somehow, this massive collection of different WordPress plugins for silly UI updates was instantly turned into malware with a crazy supply chain attack. That means one minute your countdown timer ultimate plugin is converting sales on your website, then the next minute it becomes a remote control demon on your server that steals all your data and leaks photos of your wife's boyfriend to the Kiwi Farms. WordPress remains the most ([View Highlight](https://read.readwise.io/read/01kpm4pr56cfnb8gfyfbrdsjqz)) - Tags: 👻 ai highlighted ## New Highlights added 2026-05-13 at 9:03 AM - Eight months ago, some galaxyrained hacker quietly penetrated the back door of more than 30 WordPress plugins, and no one noticed until now. Somehow, this massive collection of different WordPress plugins for silly UI updates was instantly turned into malware with a crazy supply chain attack. That means one minute your countdown timer ultimate plugin is converting sales on your website, then the next minute it becomes a remote control demon on your server that steals all your data and leaks photos of your wife's boyfriend to the Kiwi Farms. WordPress remains the most ([View Highlight](https://read.readwise.io/read/01krgpsy2aa2cgd79g32nprtcy)) - Tags: 👻 ai highlighted