Thousands of WordPress Websites Infected with Malware

Multiple sources report thousands of WordPress sites infected by a large campaign that injected third-party JavaScript to install four separate backdoors. The backdoors include a fake plugin installer for remote commands, JavaScript injection into wp-config.php, addition of attacker-controlled SSH keys for persistent shell access, and a component that fetches payloads to execute remote commands or open reverse shells.