#backdoor

Seven WordPress plugins were compromised without touching a line of their code

Attackers took credentials for a DigitalOcean Spaces bucket that BdThemes' promotional banner fetches JSON from. The plugin source stayed clean. Every admin page load ran the attacker's JavaScript anyway.