WordPress Plugins Compromised Without a Single File Change

Poisoned JSON feed let attackers backdoor WordPress sites without changing any plugin files

Source: Infosecurity Magazine