I got a few email alerts from Wordfence about malicious scripts on this site. Turns out one of the plugins installed here had ben sold on and was injecting javascript onto every page.
Critical Problems:
* File contains suspected malware URL: wp-content/plugins/widget-logic/WidgetLogicAdminConfig.php
The malicious URL matched
This was an alert that I saw whilst scanning my inbox, and also whilst looking at Wordfence scans on this blog after leaving it alone for so long. It seems that the Widget logic plugin, once which I have used on this site and many custom ones I built back in my freelance days (many years ago now) had been taken over last year, and with new releases which I have set to auto update here was injected javascript into every page.
Widget logic was one of those utility plugins that allowed a WordPress admin to set rules for when certain widgets would be displayed in sidebars, similar to condition plugins in Drupal blocks. It became a stable of mine, and many others WordPress sites as it was a handy utility that would otherwise be handled in custom code.
With 3 million downloads, this looks like it became a take over target. A new release was made in August 2024 by seemingly new owners, and that contained the embedded javascript. Austin Ginder reports on how he discovered the widget logic takeover on Anchor:
The domain widgetlogic.org was registered on June 6, 2024. Exactly two months before version 6.0.0 appeared. The new owner replaced the original single-file plugin with a multi-file structure that includes a “Live Match Widget” and a config file pointing to their domain.
He then reported this to WordPress.org, and since April 14th 2026, the Widget logic plugin has been closed.
This highlights an ongoing problem with free / open source plugins, extensions and other software. As developers priorities change, and the need for them to earn a living, frequently they get bought up. Because most sites will have auto updates switched on, as that is good practice to keep up to date with security updates, the sites then become vulnerable to the new owners intentions. In this case, injecting javascript widget into the page.
It raises the challenge for me on the future of this blog. I’ve since removed the widget logic plugin. I could have prevented the javascript injection with a content security policy, and that’s something I’ll be investigating. This blog site updates have largely been on auto pilot, so for now I’ll also monitor updates a little more carefully. This blog’s purpose, aside form being my tech blog site, was to be a window into WordPress world whilst I’m mostly in Drupal space. I kind of need something simpler so I’ll have to see what my options are.