criticalSupply chainpatchedCVSS 9.020 Oct 2026
WordPress plugin supply chain
Hackers stole a plugin maker's keys and planted backdoors
What happened
Attackers compromised a plugin vendor's release signing keys and pushed a backdoored update to thousands of WordPress sites. The update looked legitimate because it was signed.
Timeline
20 Oct 2026 · 07:00 UTC
Backdoored release
A signed plugin update ships malicious code.20 Oct 2026 · 19:00 UTC
Pulled
The release is removed from the directory.22 Oct 2026 · 08:00 UTC
Cleanup
Site owners are told to compare files against a known-good copy.
Sources