Breaking Lab srl
A plugin you trust is being used against you
If you run a WordPress site with WooCommerce — the popular e-commerce add-on — there is a live attack happening right now that you need to know about. Hackers are exploiting a security flaw in a third-party WooCommerce plugin to install a PHP backdoor. A backdoor is a hidden piece of code that lets an attacker quietly access your server whenever they want, even after you change your passwords.
The flaw in question was patched recently, meaning a fix already exists. The problem is that many site owners have not applied it yet, and attackers are racing to hit those unpatched sites before they do.
What exactly is a PHP backdoor?
PHP is the programming language that powers most of WordPress. A PHP backdoor is a small malicious script that gets written into your site’s files. Once it is there, the attacker can run any command on your server — steal customer data, redirect visitors to scam pages, or use your server to attack other sites. It is often invisible to ordinary visitors and can survive a standard plugin removal if the file is already on disk.
Why this matters more than a typical breach story
Most security stories are about someone else’s problem. This one is squarely aimed at people who self-host WordPress stores. Third-party plugins — ones built by developers outside the main WooCommerce team — are the most common route attackers use to get into WordPress sites, precisely because they are less scrutinised and updated less regularly than core software.
The pattern here is classic: a patch gets released, attackers read the patch notes to understand exactly what was broken, and then they go looking for sites that have not updated yet. The window between “patch released” and “attack begins” is now measured in hours, not weeks.
What you should do right now
First, log in to your WordPress dashboard and check the Plugins section. Look for any plugin that has an available update and apply it immediately — especially anything related to WooCommerce extensions or payment flows. Second, if you have a security scanner like Wordfence or Sucuri installed, run a full file scan today. Third, check your site’s file modification dates: any PHP file in your plugin folders that was recently changed without you doing it is a red flag worth investigating.
If you manage multiple WordPress sites, treat all of them as potentially affected and work through each one.
The bigger picture
This attack is a reminder that the plugin ecosystem is both WordPress’s greatest strength and its biggest weak point. Going forward, keeping automatic updates enabled for plugins — or at least checking for updates daily — is the single most effective habit a site owner can build. The cost of a few minutes spent updating is nothing compared to cleaning up a compromised server.
