Open Source · · 43 days
AccessPress add-ons created backdoors
AccessPress Themes' own download site was breached, turning legitimate WordPress themes and plugins into backdoored vendor ZIPs while the WordPress.org copies remained clean.
The AccessPress compromise was a vendor-site distribution attack. The same themes and plugins were clean when installed from WordPress.org, but the ZIPs served from AccessPress Themes carried added PHP. Users chose the vendor's official site and received different code.
The injected dropper lived in inital.php. When the extension ran, it modified wp-includes/vars.php and installed a cookie-driven webshell named wp_is_mobile_fix near the legitimate wp_is_mobile() function. The dropper then contacted wp-theme-connect.com and removed itself.
Jetpack found plugin timestamps clustered in early September 2021 and theme timestamps on September 22, with modified files appearing minutes after the archive contents. That pattern fit a coordinated rewrite of released ZIPs rather than ordinary development.
The blast radius was broad: dozens of free themes and plugins, plus unknown exposure for paid products. Cleanup required more than replacing the extension, because the backdoor wrote into WordPress core files after installation.
Notes
- Legacy version notes: 40 themes and 49 plugins have an identified compromised vendor version; WordPress.org-hosted copies were reported clean by Jetpack.
- Jetpack listed clean versions but no compromised version for ak-menu-icons-lite 1.0.9, ap-companion 1.0.7, wp-facebook-review-showcase-lite 1.0.9, and wp-fb-messenger-button-lite 2.0.7. Those rows are excluded from the affected inventory.
Appendix · Affected releases
- Distribution URLs were added on 2026-09-02 for 89 artifacts that carried none, each derived from the artifact's own package slug. All were requested: 27 resolve today and 62 answer 404, which is what a post-compromise listing looks like.
- Jetpack notes this plugin was not updated but was believed clean because the AccessPress-hosted copy was an older version.
27 samples linked above. Analysis and downloads are available in the lab. · 40 more could not be recovered
Indicators
- fileinital.php
- filewp-includes/vars.php
- functionwp_is_mobile_fix
- domainwp-theme-connect.com
- hashsha256:0918af9a5c6060dec985b98bbf54030cd29f1701ca9fdb6abfc1e39f90e5113e
References
- Backdoor Found in Themes and Plugins from AccessPress Themesjetpack.com
- AccessPress Themes Hit With Targeted Supply Chain Attackblog.sucuri.net
- Supply-chain attack used legitimate WordPress add-ons to backdoor sitesarstechnica.com
- Over 90 WordPress themes, plugins backdoored in supply chain attackbleepingcomputer.com
- Cybersecurity Advisory 2022-012its.ny.gov
Source record: oss/attacks/accesspress/meta.yaml