Jetpack Explores Backdoor Plug-ins in Popular WordPress Themes

AccessPress Theme customers should be looking for updated versions of the company’s WordPress themes and plug-ins because older versions of popular add-ons were compromised to deliver backdoors as part of a supply chain attack, according to Jetpack. went.

Jetpack says it discovered backdoor versions of these add-ons in September 2021. It reported the problem to AccessPress Themes a few days later, but did not receive a response until it reported the issue to the WordPress.org plug-in team. in October 2021.

AccessPress Themes then “promptly removed the offending extension from its website,” Jetpack says, and by January the company had released updated versions of most plug-ins. But it still hasn’t updated any of the affected themes as per Jetpack’s advice.

This means that AccessPress theme customers’ feedback will depend on whether they are using a company theme or one of its plug-ins. Jetpack says the former group should find a new theme; The latter group should ensure that updated versions of plug-ins are installed.

“Please note that this does not remove the backdoor from your system,” Jetpack says, “so in addition you will need to reinstall a clean version of WordPress to revert the core file modifications made during the backdoor installation.” needs to be installed.”

Jetpack says this issue does not affect AccessPress theme add-ons downloaded from the official WordPress.org directory, but users should install patched versions of the extension anyway. The company theme has also been removed from the directory.

A list of compromised AccessPress theme add-ons is available via Jetpack’s blog post. Jetpack says it only analyzes freely available themes and plug-ins, and says AccessPress Theme customers should reach out to the company for information about paid add-ons.

It seems that AccessPress Themes has not acknowledged this incident. It last tweeted in March 2021, and it hasn’t posted anything to Facebook since January 5, which is prior to Jetpack’s disclosure. The company did not immediately respond to a request for comment.

Leave a Reply

Your email address will not be published.