Multiple WordPress Plugins Compromised: Hackers Create Rogue Admin Accounts

Multiple WordPress plugins were backdoored in a supply-chain campaign (earliest signs June 21, 2024) that injects code to create rogue admin accounts (usernames “Options” and “PluginAuth”), exfiltrates those credentials to 94.156.79.8, and inserts malicious JavaScript for SEO spam; affected plugins have been removed from the directory and site owners are advised to remove suspicious admin accounts and malicious code.