WordPress Mitigates Plugin Attacks with New Security Measures 

WordPress plugin attacks can affect many sites when an attacker gains access to a plugin author’s account. In June 2024, the WordPress.org Plugin Review Team described a small group of compromised plugins. Its investigation linked the attacks to reused passwords from earlier data breaches elsewhere.

This is a historical review of that response. For present-day guidance, check the official WordPress.org security resources. WordPress.com also provides security guidance for its hosted service.

How the Plugin Attacks Happened

Attackers used recycled passwords to enter plugin author accounts and add malicious code. The team said this was not an exploit of WordPress.org itself. However, a compromised update could reach sites that depended on the affected plugin.

This is a software supply chain risk. A site may trust a normal update channel, yet harmful code can enter earlier in the release process. Therefore, developers need to protect both their accounts and their release workflow.

WordPress’s June 2024 Response

The 29 June 2024 Plugin Review Team announcement describes the response:

• Release checks: The team temporarily paused additional releases and required approval for new plugin commits. A later update to the notice says releases resumed and SVN worked as usual.
• Password resets: The team began resetting passwords for plugin authors and other users identified in breach data.
• Account protection: The notice encouraged users to enable two-factor authentication after resetting their passwords.

The release pause was temporary. It should not be read as a current instruction to stop all plugin updates. Likewise, the announcement does not support a promise that every future plugin will be safe.

What Plugin Authors Can Do

Use a unique password and protect the account with two-factor authentication. Review who can commit changes and remove access that is no longer needed. Also follow current WordPress.org notices about release and account requirements.

If an account may be compromised, follow the platform’s recovery process and review recent code changes. Do not share a password by email. Use the official sign-in page to manage account recovery.

What Website Owners Can Do

Keep an inventory of installed plugins and remove unused ones. Review security notices, maintain tested backups and plan how to recover from a bad update. Where possible, test changes on staging before production.

Technijian’s WordPress support can help review site maintenance needs. Contact the team to discuss updates, backups and security responsibilities for your site.

Frequently Asked Questions

What is a software supply chain attack?

It targets a trusted part of software development or distribution. For example, an attacker may alter a plugin before an owner installs its update.

Did the June 2024 incident exploit WordPress.org itself?

The Plugin Review Team said attackers reused passwords exposed in breaches elsewhere. Those credentials let them access a limited number of plugin accounts.

Are plugin releases still paused?

The updated historical notice says the pause ended. Check current official guidance for any plugin-specific restriction.

Does two-factor authentication remove every risk?

No. It adds account protection, but code review, secure releases, backups and incident response still matter.