What the Essential Plugin backdoor teaches about who has access to your site’s code
A WordPress plugin portfolio changed hands on Flippa and shipped a backdoor eight months before it woke up. What that says about developer access and commit rights.
-
-
A one-hour master key is still a master key: WPForms, Rank Math, and the pattern underneath
Two plugin releases six weeks apart shipped support access without a request the customer could answer — read against their own changelogs and the disclosures.
-
When your plugin’s “Help & Support” button grants itself admin
A Rank Math credential nobody consented to, a WPForms token that expired but still worked, and what building support access right actually requires.
-
What the Rank Math Application Password incident means for your own support team
Rank Math’s plugin created an admin credential without asking. A dated teardown of what happened, and a six-question check for your own support access.