A supply chain attack has compromised thousands of websites by inserting backdoors into wordpress plugins. The attack is believed to have involved dozens of plugins, potentially including those from the EssentialPlugin and ShapedPlugin suites, although the exact scope is unclear. The malicious code may have been present in some plugins since 2020, with reports suggesting over 30 plugins were affected and possibly over 400,000 websites exposed to malware.