web-security

Your WordPress Plugin Auto-Updated. Now You Have Six Backdoors.

John Z Black Apr 12, 2026

Vulnerabilities & Patching #wordpress #smart-slider #supply-chain #backdoor #joomla #patchstack #web-security

Attackers hijacked the Smart Slider 3 Pro update server and pushed a six-layer backdoor to 900,000 sites. The must-use plugin it installed doesn't show up in your WordPress dashboard. Deleting the plugin doesn't remove it.