WordPress-specific Dictionary
Plugin supply chain
Definition
Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
Also called: supply chain, supply-chain attack
Why it matters for WordPress
You inherit the security of every plugin author you install. Abandoned plugins, stolen publisher accounts, and pirated “nulled” packages keep showing up in incident reports. The update you clicked can be the delivery path.
How it shows up in practice
- Advisories about a popular plugin’s distribution or maintainer account
- Nulled or “GPL club” zips that ship webshells beside the feature you wanted
- Plugins that phone home or pull remote code at runtime without a clear reason
- A critical CVE in a dependency you forgot was still active
What to do
- Install fewer plugins; remove what you do not use.
- Prefer wordpress.org and known vendors. Never random null dumps.
- Watch for odd new files right after an update.
- Have a patch plan when a critical CVE hits something you depend on.
- Prefer maintained plugins with a clear owner over abandoned one-offs.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.
- Nulled plugin A nulled plugin is an unauthorized, usually modified copy of a paid plugin that often includes malware or backdoors.
- CVE A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
