The Hacker News

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.