WordPress-specific Dictionary
Plugin supply chain
Definition
Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
Also called: supply chain, supply-chain attack
Why it matters for WordPress
You inherit the security of every plugin author you install. Abandoned plugins, stolen publisher accounts, or malicious “nulled” packages are recurring incident causes.
How it shows up in practice
- Security advisories about a popular plugin’s distribution
- Nulled/pirated plugins that ship backdoors
- Dependencies that pull remote code at runtime
What to do
- Install fewer plugins; remove what you do not use.
- Prefer reputable sources (wordpress.org, known vendors), never random null dumps.
- Watch for unusual plugin updates or new files after update.
- Have a patch plan when a critical CVE hits a plugin you depend on.
Related terms
Nearby ideas in the dictionary
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.