Wordfence 报告 BdThemes 供应链通过 WordPress 管理提要遭到妥协
Wordfence 报告说，通过 BdThemes 的推广系统在 WordPress 仪表板内传送了恶意代码，此前攻击者已污染了供应商控制的 JSON 提要。
By Ryan Merket · Published
Primary source: BleepingComputer
为何重要
在 wp-admin 内获取供应商控制的促销内容的插件开发者，会将该上游系统添加到保护已登录管理员的安全边界中。
Selim Rana's BdThemes built its WordPress business by giving site owners a large catalog of design tools. A reported compromise of the infrastructure behind those products exposed the risk embedded in one shared feature: a promotional feed that ran inside customers' authenticated admin dashboards.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.