WordPress Supply Chain Attack Spreads Across Multiple Plug-ins

Wordfence discovered a supply-chain attack that injected malicious code into multiple WordPress.org plugins (notably Social Warfare with >30,000 installs) that creates unauthorized administrative accounts, injects malicious JavaScript and SEO spam, and exfiltrates credentials to an attacker-controlled server (94.156.79.8); affected plugins have been delisted, some patched, and Wordfence published IoCs and cleanup guidance.