The WordPress Security Team is aware of multiple ongoing phishing scams impersonating both the “WordPress team” and the “WordPress Security Team“ in an attempt to convince administrators to install a plugin on their website which contains malware.

The WordPress Security Team will never email you requesting that you install a plugin or theme on your site, and will never ask for an administrator username and password.

If you receive an unsolicited email claiming to be from WordPress with instructions similar to those described above, please disregard the emails and indicate that the email is a scam to your email provider.

These emails link to a phishing site that appears to be the WordPress plugin repository on a domain that is not owned by WordPress or an associated entity. Both Patchstack and Wordfence have written articles that go in to further detail.

Official emails from the WordPress project will always:

• Come from a @wordpress.org or @wordpress.net domain.
• Should also say “Signed by: wordpress.org” in the email details section.

The WordPress Security Team will only communicate with WordPress users in the following locations:

• the Making WordPress Secure blog at make.wordpress.org/security
• the main WordPress News site at wordpress.org/news

The WordPress Plugin team will never communicate directly with a plugin’s users but may email plugin support staff, owners and contributors. These emails will be sent from [email protected] and be signed as indicated above.

The official WordPress plugin repository is located at wordpress.org/plugins with internationalized versions on subdomains, such as fr.wordpress.org/plugins, en-au.wordpress.org/plugins, etc. A subdomain may contain a hyphen, however a dot will always appear before wordpress.org.

A WordPress site’s administrators can also access the plugin repository via the plugins menu in the WordPress dashboard.

As WordPress is the most used CMS, these types of phishing scams will happen occasionally. Please be vigilant for unexpected emails asking you to install a theme, plugin or linking to a login form.

The Scamwatch website has some tips for identifying emails and text messages that are likely to be scams.

As always, if you believe that you have discovered a security vulnerability in WordPress, please follow the project’s Security policies by privately and responsibly disclosing the issue directly to the WordPress Security team through the project’s official HackerOne page.

---

Thank you Aaron Jorbin, Otto, Dion Hulse, Josepha Haden Chomphosy, and Jonathan Desrosiers for their collaboration on and review of this post.

Sourceon

<aSecure

datasent

sayimpersonation

org/security</a></li>on

rel="nofollowhref="https://profiles

intobe

wordpressplugin

installdirectly

infurther

Teamalso

thecom

aemail

emailon

target="_blank"multiple

installmalware/">Patchstack</a>

toscams/">Source</a><a

rel="nofollowto

domainthat

by:href="https://gistgrill

fromThe

target="_blank"to

<strong>TheWordPress

andteam

</ul>recalc

ng"href="https://gistgrill

ng"Security

Atarget="_blank"

comindicate

noopener">on</a><a

cvethe

noopener">from</a><ahref="https://techpros

theng"

rel="nofollowsite

aand

Jorbin</a>dashboard

target="_blank"noopener">on</a>

src="https://techprosnoopener">to</a>

installhave

noopener">Jorbin</a></a><aand

target="_blank"rel="nofollow

phishingnoopener">from</a><a

both<a

comnoopener">scams/">Source</a><a</a>

messagesrel="nofollow

WordPresstarget="_blank"

<aor

target="_blank"Security

ng"href="https://techpros

convinceng"

target="_blank"rel="nofollow

noopener">href="https://techpros</a>com

theseclass="wp

href="https://techprossay

rel="nofollowform

rel="nofollowblock

malwaretricks

disclosingnoopener">target="_blank"</a><a

rel="nofollow“Signed

comemail

<atarget="_blank"

noopener">multiple</a>com

reviewhref="https://techpros

beto

site’sng"

<ang"

comsome

ng"noopener">say</a><a

class="wpas

phishinghref="https://gistgrill

target="_blank"ng"

href="https://gistgrilltarget="_blank"

rel="nofollowng"

comrel="nofollow

noopener">on</a>target="_blank"

emailplugin

noopener">rel="nofollow</a>an

andng"

comng"

rel="nofollowrel="nofollow

png"target="_blank"

href="https://techproshref="https://gistgrill

officialcom

href="https://gistgrillrel="nofollow

href="https://techprosrel="nofollow

havehref="https://techpros

WordPresscve

ng"target="_blank"

comtarget="_blank"

ng"com

rel="nofolloworg/plugins">fr

href="https://techprosnoopener">Security</a>

href="https://gistgrillrel="nofollow

noopener">multiple</a>noopener">href="https://gistgrill</a>

rel="nofollow<a

Thetarget="_blank"

href="https://techprosnoopener">org/plugins">fr</a>

comnoopener">data</a><a

noopener">phishing</a><ahref="https://techpros

ng"ng"

Aetc

andrel="nofollow

noopener">rel="nofollow</a><acontains

href="https://techprostarget="_blank"

noopener">plugin</a>noopener">site</a>

comng"

href="https://techprosrel="nofollow

comcom

themecom

noopener">target="_blank"</a>please

target="_blank"will

rel="nofollow<a

comng"

rel="nofollowrel="nofollow

comtarget="_blank"

ng"ng"

andbe

target="_blank"target="_blank"

ng"site

noopener">and</a>the

includecom

occasionallysite’s

ng"target="_blank"

rel="nofollowrel="nofollow

com