Audits

4 malicious audits. · 83 IOCs catalogued.

Verdict: All (11) Malicious (4) Cleaned (1) Suspicious (0) Inconclusive (0) Benign (6) In progress (0)

Malicious Closed by wp.org Audit #12 Scroll To Top (20k+ installs) 11 IOCs 7d ago

Update-checker hijack with active stored-XSS / RCE primitives served from a Panama-fronted C2. scroll-top (20,000 active installs) was sold by original author Ga Satrya (@gasatrya) to an actor identified as Benjamin (wp…

baseline — → head 1.5.3 · event #728 · investigator beacon-scan-skill

Malicious Closed by wp.org Audit #10 Widget Logic (100k+ installs) by widgetlogics 8 IOCs 10d ago

Verdict: malicious. Confirmed supply-chain compromise matching the disclosed attack at anchor.host/how-i-caught-a-wordpress-plugin-supply-chain-attack and covered by TheNextWeb, Yahoo Tech, BigGo, byteiota, and others. …

baseline 5.10.4 → head 6.0.0 · event #103 · investigator austin

Malicious Closed by wp.org Audit #4 33-plugin suite (180k+ combined installs) by essentialplugin 15 IOCs 10d ago

Marketplace acquisition of an established 30-plugin portfolio used as a vehicle for a fleet-wide PHP-deserialization RCE backdoor with on-chain C2 resolution. A buyer identified only as "Kris" purchased the entire Essen…

baseline 2.6.6 → head 2.6.9.1 · event #104 · investigator austin

Malicious Closed by wp.org Audit #13 Quick Page/Post Redirect Plugin (70k+ installs) by anadnet 12 IOCs 22d ago

The original author intentionally weaponized wordpress.org distribution to seed an out-of-band update channel they controlled — and then served tampered builds through that channel after the wp.org-distributed code went…

baseline 5.2.1 → head 5.2.4 · investigator manual