Important Vulnerability on Advanced Custom Fields Plugin for WordPress

An attacker gets in through a vulnerable plugin. They drop a backdoor file in wp-content/uploads. In the same session, they write a redirect script into wp_options and a spam link into wp_posts.post_content. A file scanner finds the backdoor. The database UPDATEs stay. The site gets cleaned and still serves pharma spam to search engines the next morning.

If you have a successful WordPress (or other PHP-based) security plugin, you probably know this scenario. You’ve built a solid product. Maybe it’s a login limiter, an activity logger, or a firewall. You have tens of thousands (or millions) of active installs. The reviews are great.