WordPress Plugin Comes With a Backdoor, Steals Admin Credentials In Cleartext

Posted by timothy on Friday March 4, 2016 @10:44PM from the considered-harmful dept.

An anonymous reader writes that a WordPress plugin for managing custom post types has apparently been forcibly taken over by an Indian developer who has added a backdoor to the code which lets him install files on infected sites. "This backdoor also allows him to download files which add his own admin account to the site, and even alter core WordPress files so every time a user logs in, edits his profile, or a new user account is created, the user's password is collected (in cleartext) and sent to his server. WordPress hasn't moved in to ban the plugin just yet, despite user complaints.

1 of 76 comments (clear)

Min score:

Reason:

Sort:

Re:plugin has been suppressed from the wordpress s by Megol · 2016-03-05 02:09 · Score: 1, Interesting

Your post doesn't make sense! Observe that we aren't talking about a bug or backdoor in a MS product, just that software that uses the public API to do something. So do you really blame MS when someone downloads something that can run on a Windows machine and it happens to be malware?
If so I hope you blame Linus whenever someone installs some malware on their Linux machine...