Popular WordPress redirect plugin hid dormant backdoor for years

A hidden self-update mechanism shipped in Quick Page/Post Redirect plugin versions 5.2.1/5.2.2 routed update checks to an external domain (anadnet.com), enabling a tampered 5.2.3 build to be silently delivered that included a passive backdoor (triggering for logged-out users) likely used for SEO spam; the updater could also allow arbitrary remote code execution. WordPress.org removed the malicious updater and pulled the plugin pending review, but about 70,000 installs may still point to the malicious update server and remain at risk; affected users are advised to uninstall and reinstall a clean 5.2.4 from WordPress.org when available.