Ex-Employee Hacks WPML WordPress Plugin Site and Spams Users

[silversurfer]

Last night the web site for the WordPress Multilingual Plugin (WPML) WordPress plugin was hacked and users of the plugin started receiving receiving emails stating that the plugin is filled with vulnerabilities. According to WPML, this was caused by a ex-employee who left a backdoor in their site.

WPML is a plugin that allows you to add multilingual support to WordPress and according to their site is used by 600,000 users.

In a blog post by WPML developer Amir Helzer, the company explains that the hack and resulting spam emails were sent by an alleged ex-employee who left a backdoor in their site. Helzer went on to say that they have updated their site, rebuilt the code, and secured access to the admin account with 2FA.

Source: https://www.bleepingcomputer.com/news/se...ams-users/