Someone planted backdoors in dozens of WordPress plug-ins used in thousands of websites

A supply-chain backdoor was discovered in dozens of WordPress plugins from a vendor called Essential Plugin after the plugins changed ownership; the backdoor, dormant for months, activated and began distributing malicious code to sites that had the plugins installed. WordPress lists the affected plugins in over 20,000 active installations (the vendor claims up to 400,000 installs); the plugins have been removed from the directory and site owners are advised to check for and remove the compromised plugins.