WordPress Supply Chain Attacks: BuddyBoss, Gravity Forms, and the Trust Problem

Three separate WordPress plugin vendors had their update or download infrastructure compromised between June and March 2026, turning legitimate software updates into malware delivery vehicles. BuddyBoss, Gravity Forms, and Groundhogg each fell victim to the same class of attack: compromise the vendor's distribution channel rather than the sites themselves, then let the auto-update mechanism do the rest.

Combined, these three incidents exposed over one million WordPress installations to backdoored plugin updates delivered with a valid vendor signature over an authenticated channel. The trust that makes auto-updates safe is exactly what makes this attack class so effective.

This post covers the technical details of each incident, why conventional defenses fail against supply chain delivery, the ten Linux Malware Detect signatures we published for detection, and a step-by-step remediation checklist for affected installations.

The Pattern#

Despite three different vendors, three different timeframes, and three different threat actors, the attack chain was nearly identical in each case. Understanding the shared playbook is the first step toward building defenses that hold across future incidents.

1. Compromise the distribution layer, not the code repository. In all three cases the GitHub repository remained clean. The attacker targeted the vendor's update server, download portal, or build pipeline: the infrastructure between the source repository and the end site.
2. Inject into a core loader file that runs on every page load. Targets were not obscure utility files. BuddyBoss: bp-loader.php. Gravity Forms: common.php. Groundhogg: includes/license.php. All are required includes loaded early in the WordPress bootstrap.
3. Add credential harvesting and remote shell capability. Each backdoor combined two objectives: exfiltrate high-value credentials (database passwords, Stripe keys, admin passwords) and establish persistent remote code execution via reverse shell or eval-based command handler.
4. Exfiltrate via typosquatted or lookalike C2 domains. C2 infrastructure was registered days before the attack and designed to blend into traffic monitoring. Gravity Forms: gravityapi[.]org and gravityapi[.]io (legitimate domain is gravityapi.com). Groundhogg: groundhogg[.]org (legitimate domain is groundhogg.io).
5. Let the trust relationship deliver the payload automatically. Sites that had auto-updates enabled received the backdoored plugin without administrator interaction. The update was signed and delivered over HTTPS from the legitimate vendor's infrastructure.

This playbook is not novel. It mirrors the SolarWinds pattern at the WordPress ecosystem scale. What makes it particularly dangerous here is the density of the target space: tens of thousands of independently operated WordPress sites, most running automated updates, all trusting the same handful of plugin vendors.

BuddyBoss, March 17, 2026#

On March 17, 2026, threat actors compromised BuddyBoss's update server and pushed trojanized versions of both the BuddyBoss Platform plugin and the BuddyBoss Theme. The compromise was discovered on March 19 by Cybernews researchers who located an exposed C2 server containing the stolen data. By that point 309 sites had already been confirmed compromised, with 27,000+ servers in the broader BuddyBoss ecosystem considered at risk.

Post-incident analysis attributed the attack to a French-speaking threat actor who used an AI assistant (specifically Claude) to help craft the attack chain, making it an early documented case of AI-assisted plugin supply chain compromise.

Compromised Files

Two files were replaced in the trojanized distribution packages. Both are first-loaded bootstrap files that run on every WordPress page request:

The clean version of bp-loader.php is available in the BuddyBoss GitHub repository. If your installed file's hash matches either value above, treat the installation as compromised.

Backdoor Capabilities

The malicious bp-loader.php contained three functional components layered on top of the legitimate plugin bootstrap code:

All exfiltration used wp_remote_post() or direct curl_exec() calls, blending into normal outbound HTTP traffic generated by legitimate WordPress plugins.

Gravity Forms, July 9–10, 2025#

On July 9–10, 2025, Gravity Forms' download infrastructure was compromised and manual installer ZIP packages were replaced with backdoored versions. The affected versions were 2.9.11.1 and 2.9.12. Gravity Forms reports over one million active installs, making this the highest-exposure incident of the three. The attack was documented in detail by Patchstack.

Backdoor Mechanism

The attacker modified gravityforms/common.php (the plugin's core shared library, loaded on every page) and deployed three additional files that served as the command handler and data staging area:

The C2 communication used a function named update_entry_detail() (a name chosen to blend with Gravity Forms' legitimate entry API) which collected site metadata (WordPress version, installed plugins, admin email, server path) and POSTed it to the C2 domain. The C2 response delivered a base64-encoded PHP backdoor that was written to disk and included into the runtime.

C2 Infrastructure

The attacker registered two domains on July 8, 2025, one day before the attack, designed to be indistinguishable from legitimate Gravity Forms API traffic in access logs:

Both domains were registered with privacy protection and hosted on bulletproof infrastructure. Neither appeared in any blocklist at the time of the attack, because they were freshly registered and had no prior reputation signal.

Groundhogg, June 27, 2025#

On June 27, 2025, Groundhogg (a WordPress CRM and marketing automation plugin) discovered a malicious file had been injected into their distribution package. The vendor disclosed the incident directly on their press page, describing it as a targeted supply chain attack.

The malicious file was includes/license.php, which does not exist in the legitimate plugin. Its presence in the package was the primary indicator of compromise. The C2 domain was groundhogg[.]org (the legitimate domain is groundhogg.io), which was suspended shortly after discovery.

The Groundhogg incident is notable for the speed and transparency of the vendor response. Public disclosure occurred the same day as discovery, with specific indicators and remediation steps. Compare this with the industry norm of delayed or vague disclosures, and it represents the right model for handling supply chain incidents.

Why This Bypasses Everything#

Supply chain attacks on plugin distribution infrastructure circumvent nearly every layer of a conventional WordPress security stack. This is not a failure of implementation; it is a structural consequence of how the WordPress update trust model works.

The Trust Model

WordPress establishes trust transitively: a site administrator trusts a plugin vendor, and that vendor's update server delivers signed packages over HTTPS. When the attacker controls the update server, they inherit that trust. Every security control that operates below the trust boundary (file integrity monitoring, WAF rules, IDS signatures) is blind to the initial compromise because the payload arrived over a legitimate, authenticated channel.

What Actually Detects It

Given the above, detection options fall into three categories:

The Patchstack 2026 report noted that premium plugins (paid, outside WordPress.org) accounted for 33 zero-day vulnerabilities in 2025, three times the rate of free plugins. The distribution infrastructure for premium plugins is also entirely outside the WordPress.org review process. These two factors together make premium plugin vendors the highest-risk point in the WordPress supply chain.

Linux Malware Detect Signatures#

We have published ten new signatures across three detection formats in Linux Malware Detect (LMD). Four hex pattern signatures target BuddyBoss-specific payload markers. Four compound signatures combine plugin context with attacker capability markers, including two generic patterns that will match future supply chain attacks against any WordPress plugin. Two SHA256 exact-match signatures target the known compromised BuddyBoss files.

Hex Signatures (LMD 1.6+)

These four signatures use byte-pattern matching against the BuddyBoss bootstrap header combined with specific attacker code patterns. They require LMD 1.6 or later for hex matching support.

Compound Signatures (LMD 2.x)

Compound signatures use boolean AND/OR logic across multiple pattern clauses. These are more expressive than hex patterns and can encode semantic context. For example, "a file that contains BuddyBoss plugin markers AND any of several execution sinks." The two generic signatures at the bottom are designed to catch future supply chain attacks against any WordPress plugin, not just BuddyBoss. For a deep dive on the detection language itself, see Compound Signatures: Building a Boolean Detection Language in Bash.

SHA256 Exact-Match Signatures

Two exact-hash signatures match the known-bad BuddyBoss files by their SHA256 digest. These provide zero false positives and match regardless of content obfuscation, but only detect the specific known variants.

LMD users can receive all ten signatures by running:

maldet --update-sigs
maldet --scan-all /var/www/html/wp-content/plugins/

For a more targeted check against the known BuddyBoss compromised files specifically:

maldet --update-sigs
# Scan the BuddyBoss platform plugin loader
maldet --scan-all /var/www/html/wp-content/plugins/buddyboss-platform/bp-loader.php
# Scan the BuddyBoss theme
maldet --scan-all /var/www/html/wp-content/themes/buddyboss-theme/functions.php

Remediation#

If you are running BuddyBoss Platform 2.20.3, BuddyBoss Theme 2.19.2, Gravity Forms 2.9.11.1 or 2.9.12 installed during July 9–10 2025, or any Groundhogg version received on June 27 2025, treat the installation as compromised and follow these steps in order.

# Check BuddyBoss Platform loader
sha256sum wp-content/plugins/buddyboss-platform/bp-loader.php
# Compromised: ddda12b545a7b817883641421cf6a213f4c5100effa40cdb55018efce11bbe42

# Check BuddyBoss Theme
sha256sum wp-content/themes/buddyboss-theme/functions.php
# Compromised: 5027a0e77eca13a5cc120d3e37262c4073452569ad341cd1558051b5a91ce144

# Check for Gravity Forms dropped files (should not exist in clean install)
ls -la wp-includes/bookmark-canonical.php
ls -la wp-includes/block-caching.php
ls -la notification.php

# Check for Groundhogg backdoor file (should not exist in clean install)
ls -la wp-content/plugins/groundhogg/includes/license.php

# Audit WordPress admin users for unauthorized accounts
wp user list --role=administrator --fields=user_login,user_email,user_registered

# Scan the full installation with updated LMD signatures
maldet --update-sigs
maldet --scan-all /var/www/html/

# Check for recently modified PHP files outside plugin/theme directories
find /var/www/html/wp-includes/ -name '*.php' -newer /var/www/html/wp-login.php -ls
find /var/www/html/wp-admin/ -name '*.php' -newer /var/www/html/wp-login.php -ls

# Review server access logs for reverse shell activity
grep -E 'fsockopen|stream_socket|proc_open' /var/log/apache2/access.log
grep -E 'CONNECT|:443|:4444|:1337' /var/log/apache2/access.log

Indicators of Compromise#

BuddyBoss File Hashes

# Compromised BuddyBoss Platform 2.20.3
ddda12b545a7b817883641421cf6a213f4c5100effa40cdb55018efce11bbe42  bp-loader.php

# Compromised BuddyBoss Theme 2.19.2
5027a0e77eca13a5cc120d3e37262c4073452569ad341cd1558051b5a91ce144  functions.php

Gravity Forms C2 Domains and IPs

# Typosquatted C2 domains (legitimate domain: gravityapi.com)
gravityapi[.]org
gravityapi[.]io

# C2 IP addresses
185.193.89.19
193.160.101.6

# Dropped files (presence indicates compromise, not part of clean install)
wp-includes/bookmark-canonical.php
wp-includes/block-caching.php
notification.php

Groundhogg C2 Domain and Backdoor File

# Typosquatted C2 domain (legitimate domain: groundhogg.io)
groundhogg[.]org  [suspended]

# Backdoor file (presence indicates compromise, not part of clean install)
wp-content/plugins/groundhogg/includes/license.php

Affected Version Windows

MITRE ATT&CK Mapping#

The techniques observed across these three supply chain incidents map to the following MITRE ATT&CK entries:

Conclusion#

Three supply chain attacks against WordPress plugin distribution infrastructure in under a year is not coincidence. It reflects a deliberate attacker shift toward the distribution layer, where a single compromise yields access to thousands of sites simultaneously, and where conventional defenses are structurally blind.

The Patchstack statistic is worth restating: 11,334 new WordPress vulnerabilities in 2025, with a median time of five hours from disclosure to mass exploitation. The ecosystem is under sustained, systematic pressure. Supply chain attacks are the logical escalation: instead of exploiting individual site vulnerabilities one at a time, attackers compromise the trusted update infrastructure that serves all sites at once.

For defenders, the takeaways are practical: