welcome on my personal website!
“This is it… this is where I belong…”
I know everyone here… even if I’ve never met them, never talked to
them, may never hear from them again… I know you all…
tl;dr: Like the novel “Dependency Confusion” supply chain attack, it is possible to take over internally developed WordPress plugins unclaimed on the wordpress.org registry. Updating the plugin might result in the RCE or installing a PHP backdoor. You can use wp_update_confusion.py to scan for potential targets. To protect your website,...