Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel

Description

The plugin was distributed with a hidden update mechanism that fetched plugin updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to sites, allowing the attacker controlling that server to inject arbitrary content into pages and to deliver arbitrary code to affected sites.

Version 5.2.1, as published on WordPress.org, bundled the Plugin Update Checker library (updater/ directory) configured to poll https://anadnet.com/updates/?action=get_metadata&slug=quick-pagepost-redirect-plugin. In March 2021 that server delivered a modified 5.2.3 build, different from the 5.2.3 later published on WordPress.org, which kept the update channel and added a the_content filter that, for logged-out visitors on single posts and pages, fetched content from https://w.anadnet.com/bro/3/ (passing the site host, request URI and visitor User-Agent) and prepended the response to the post (observed serving SEO spam links to search engine crawlers). Because the version string matched a later WordPress.org release, affected sites were not offered a clean update until 5.2.4.

Indicators of compromise:
- Outbound requests to anadnet.com or w.anadnet.com
- An updater/ directory (Plugin Update Checker, Puc v4p10) inside wp-content/plugins/quick-pagepost-redirect-plugin/
- The strings filter_the_content_in_the_main_loop, ppr_pro, QQQEND or w.anadnet.com in page_post_redirect_plugin.php
- page_post_redirect_plugin.php with MD5 ad717da18cf8a2b69899c0d7dafee05a (tampered 5.2.3)

Remediation: remove the plugin (it has been closed on WordPress.org), or at minimum reinstall the clean 5.2.4 from WordPress.org, delete any leftover updater/ directory, verify the files with "wp plugin verify-checksums quick-pagepost-redirect-plugin", clear the opcode cache, and treat any site that ran the tampered build as potentially compromised.