WordPress Redirect Plugin Hid Backdoor and Unauthorized Update Mechanism

Summary

A researcher found that Quick Page/Post Redirect versions 5.2.1 and 5.2.2 used a hidden updater linked to anadnet[.]com; a tampered 5.2.3 build added a backdoor. WordPress.org pulled the plugin pending review.

Key points

Quick Page/Post Redirect, installed on more than 70,000 sites, contained a hidden self-update mechanism in versions 5.2.1 and 5.2.2, released in 2020–2021.
The updater pointed to anadnet[.]com and could push arbitrary code outside WordPress.org’s review process.
According to researcher Austin Ginder, sites received a tampered 5.2.3 build from the external server in March 2021; its hash differed from the WordPress.org version.
The added backdoor ran for logged-out users through the_content and fetched data from the anadnet server; Ginder said it was likely used for cloaked SEO spam.
The updater reportedly remains on affected installations but is dormant because its command-and-control subdomain does not resolve; the article says the domain is active.
WordPress.org temporarily pulled the plugin pending review. Users are advised to uninstall it and install a clean 5.2.4 copy from WordPress.org when available.

Article Details

Event Type: Backdoor and malicious self-update mechanism in the Quick Page/Post Redirect WordPress plugin
Impact: Versions 5.2.1 and 5.2.2 contained a hidden updater that could deliver arbitrary code from an external server. A tampered 5.2.3 build added a passive backdoor that ran for logged-out users and was likely used for cloaked SEO spam. The article reports more than 70,000 installs; WordPress.org temporarily pulled the plugin pending review.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`anadnet[.]com`	External domain used by the plugin’s hidden self-update mechanism to deliver arbitrary code; the article also describes it as the backchannel server.
HOSTNAME	`w[.]anadnet[.]com`	External server that supplied the tampered 5.2.3 plugin build containing the passive backdoor.