A WordPress Security Flaw Hid Undetected for Five Years

A tool used by 70,000 WordPress websites contained hidden malicious code for five years. The code allowed hackers to inject their own commands into compromised sites, but lay dormant until activated. Discovered in April 2026, it shows how attackers can slip past security checks by staying quiet and waiting.