Attacker compromised 30 WordPress plugins via acquisition

A single actor purchased ownership of multiple WordPress plugins and injected backdoors into all of them, potentially affecting thousands of sites. This underscores a real supply-chain risk for indie WordPress developers: abandoned plugins are acquisition targets, and plugin marketplaces lack effective ownership verification.