Popular WordPress redirect plugin hid dormant backdoor for years
(bleepingcomputer.com)
1.
2.
Someone bought 30 WordPress plugins and planted a backdoor in all of them
(news.ycombinator.com)