Dozens of popular WordPress plug-ins have been taken offline after a backdoor was discovered in their source code, allowing malicious code to be pushed to any website using them. The discovery came after the new corporate owner of Essential Plugin added the backdoor last year, which only activated earlier this month.

Austin Ginder, founder of Anchor Hosting, warned that without notification of ownership changes, users are exposed to potential compromise by their new owners. This incident follows another hijack just weeks prior and highlights ongoing risks in software supply chains.

With over 400,000 plug-in installations and 20,000 active WordPress sites affected, the impact is significant. Ginder advises users to check for and remove any of the malicious plug-ins from their websites immediately. Essential Plugin's representatives did not respond to requests for comment.

The incident underscores growing concerns about software security and the potential vulnerabilities introduced by changes in ownership within the tech industry.