WordPress: 31 Plugins Backdoored via Flippa Acquisition
An attacker legally purchased 31 WordPress plugins on Flippa, inserted a dormant backdoor, and waited 8 months before activating it. The command-and-control domain was resolved through an Ethereum smart contract — making the C2 layer blockchain-mutable and resistant to standard DNS-level takedown. Because plugins run with full database and filesystem access by default, activation gave the attacker unrestricted host access across all affected sites. 96% of recent WordPress CVEs trace to plugins.
Why It Matters
No CVE can prevent a legitimate acquisition. Plugin-trust models based on marketplace reputation cannot defend against this class of dormant supply-chain attack. Cloudflare's new MIT-licensed Mdash project responds with per-plugin manifest-declared capability sandboxing — the structural countermeasure the WordPress architecture lacks.