WordPress captcha plugin on 300,000 sites had a sneaky backdoor

So, the "rebranding" excuse was BS...

The Wordfence plugin notified me that "Captcha" had been withdrawn from the Wordpress repository a week or so back, which got my attention. However, the plugin page claimed that this was because the name they'd been using- "SimplyWordpress"- was against WP's rules (i.e. suggesting some nonexistent affiliation with Wordpress itself) and it would be back shortly, after they'd rebranded.

As excuses go, this was rather too plausible, and not- it now appears- the real reason.

Just move on

WordPress itself looks like a fairly well-written app. But behind the scenes contains a lot of spaghetti php code. But it's php, right? The plugin market is full of awful, horrible, broken code though. There are plugins whose enabling will bring a moderately busy site to its knees, or so bollox up the MySQL db that a nuke and pave is the only solution. Conflicts between plugins, or between plugins and even the stock official themes, are so common that its clear very few authors do very much testing. Automattic (WP's publisher) is up front about the fact that they don't vet plugins published by 3rd parties over on wordpress.org.

The best advice to those on WP is to just move on. There are alternatives, although none singing the "so easy to install, easy to use, even techologically clueless man-children of all ages can do it" siren's song.

Installed confirmed on my webstie, but disabled

I had this plug-in installed on my websites (I guess most of them). I had some time ago disabled it due to how problematic it was. This was before it was compromised. I'll just go now and delete it.

httpd logs

A quick glance at the logs should be a glaring indication that you should not be using a content management system that is so heavily targeted. I'm sure Wordpress take security very seriously and lots of the bad press they get is due to 3rd party plugins, but it still doesn't stop you, the user from having a massive target on your forehead.

It is the simple reason why javascript gets blocked by default on a domain level granularity at the browser

very interesting read! sounds as if they are making tons of dollar$$$

Problem is in the UK they are far behind the rest of the world in understanding this type of crime. Something should really be done as if no example is set, more people will carry out this sort of stuff due to there being no repercussions. If they get away with it why shouldn't anyone else try it?

An example should set, where does it stop if not?