Supply Chain Attack Compromises Official GravityForms Plugin Repository

Summary

A supply chain attack compromised the official GravityForms plugin repository, injecting backdoors into legitimate plugin downloads. The breach allowed attackers to execute remote commands on WordPress sites using the plugin. The article details the discovery of malicious code, the IP addresses involved (193.160.101.6), the use of a gf_api_token parameter for command-and-control, and the ongoing investigation. The attack targeted multiple versions of the plugin (2.9.11.1 and 2.9.12), and the backdoor code was designed to appear as legitimate plugin functionality. The article provides technical analysis of the malware's behavior, including file exfiltration and remote code execution capabilities.