CVE-2026-73533 is being characterized as embedded malicious code, but the actual attack vector is infrastructure abandonment — a supply chain infiltration that the WordPress plugin ecosystem is uniquely ill-equipped to handle. A developer decommissioned their update server, the domain lapsed, and an attacker registered it. The tampered build then served to every installation still configured to poll that endpoint for updates.
This is not a zero-day vulnerability — it's a predictable failure mode that the security community has seen repeated across abandoned DNS, lapsed subdomains, and exposed cloud buckets, yet never systematized as a class of risk. The WordPress plugin update architecture has no concept of update path revocation. Plugin authors hardcode update URLs with no expiration semantics, no certificate pinning, no revocation mechanism. When an update server dies, the trust relationship it represented doesn't die with it — it becomes dangling infrastructure waiting to be picked up.
The tampered build exploits specific blind spots in standard cleanup procedures. It plants persistence in mu-plugins, a directory designed for must-use functionality that persists across plugin changes. Security tooling that monitors plugin directories for malicious code won't catch a dormant backdoor here. Standard remediation workflows — delete the plugin, restore from backup — will miss it entirely.
The passwordless admin account is the secondary persistence layer. It survives both plugin removal and standard forensic cleanups that focus on weak credentials or unauthorized users. From that account, the attacker has database access, filesystem write capability, email sending, and the ability to install arbitrary plugins or modify theme templates. If any compromised site has external service integrations — payment processors, cloud storage, CRM plugins — the pivot surface extends beyond the WordPress install itself.
For defenders: identify any hardcoded update endpoint URLs in your plugin configuration and verify those domains are still controlled by the original maintainer. Enumerate mu-plugins and any recent modifications to the uploads directory — both are persistence locations that fall between standard security checkpoints. Audit your user database for accounts you didn't create, including passwordless accounts that bypass standard account audits. The exposure window matters as much as the severity — if this tampered build went undetected for months, each day compounded the blast radius across every installation that pulled the update.