I have a short update.

1. We’re still working on our website (wpml.org). The work will complete today. Much of the security update includes applying 2 factor authentication to critical points.

2. The first thing that we checked was that the plugins (WPML and its components) are not affected. They are not. There is no malicious code in our plugins.

3. No payment information was lost. We don’t store payment information on wpml.org (use PayPal and Stripe who are keeping the payment information secure on their systems).

4. We wrote an email to our clients describing the incident. Mostly, we asked in this email to change their passwords on wpml.org.

5. I’ll write a blog post on wpml.org with all the relevant information once we’re 100% done, but we shouldn’t do it before.

Since the attacker had access to our site’s admin, he also had access to our mailer. We immediately disabled the mailing from our server. This would explain not getting a question from WPTavern or from other concerned clients. During this time, our site did not send out emails, so a number of clients are still waiting for their login details. We’re completing this now and will get back to everyone.

We have to admit that our site was not secured well enough. If someone previously had admin access and stopped working for us, we should have been more careful and avoided this situation.

BTW – This can be a wakeup call for others. We talk a lot about the benefits or remote work and most of the WordPress industry works remotely. This made us realize that we need to be a lot more pessimistic when we allow any access to our system.

For example, the fact that we’re now coding for ourselves a requirement to login with 2fa, means that we’re not alone in this exposed situation.