In the past few days, a popular WordPress plugin has had to contact all of its customers after its plugin was hacked. Named, WPML (WP MultiLingual), the plugin is one of the most popular for translating sites into multiple languages.
According to the company itself, WPML has over 600,000 paying customers. They have built such a good reputation, that they don’t need to offer a free version of their plugin.
Major Incident
On Saturday 19th January, the WordPress plugin suffered its first major incident since 2007 when it was created.
The company claims that a former employee sent an email to all the plugin’s customers. The email claimed that he was a security researcher, and had found many vulnerabilities. He also claimed that his warnings were ignored by the WPML team. He urged all customers of the plugin to check their sites for any breaches.
WPML Denial
Following this email, several customers took to social media to ask WPML about the email. Some were amazed at how the hacker got access to the site and sent the email so easily. The WPML team released its own mass email to customers, disputing the claims.
WPML claim that the email came from a former employee, who left a backdoor on their official website. They were then able to access the companies database and sent the mass email.
No Other Data Accessed
Website developers stated that the employee didn’t get access to any financial data. However, they didn’t rule out the possibility of the hacker logging into customers WPML.org accounts.
The company has said it will rebuild the server and remove the backdoor. They are also resetting all customer passwords as a precaution. They confirmed that the hacker had no access to the plugin’s code.
It is unclear if WPML has reported the former employee to the authorities.