Every way a WordPress plugin can change hands
You are trusting whoever controls each plugin on your site today, not whoever wrote it. Here is every way that person changes.
WordPress.org permits every route below, requires an announcement for none of them, and notifies the sites running the plugin about none of them either. They differ in how visible they are, and that turns out to matter more than how they happen.
1. Outright sale
The most discussed route, because it is the one behind the April 2026 incident: a portfolio of 31 plugins bought through Flippa and backdoored across the lot. Marketplaces list WordPress plugins openly, priced on install count.
Visibility: good, after the fact. The listed author usually changes and new usernames appear in the commit log. Nothing announces it, but the public record does move.
2. Adoption of an abandoned plugin
WordPress has a formal process for taking over a plugin whose author has stopped responding. Someone asks the Plugins Team, the team tries to reach the original author, and if there is no response the plugin can be reassigned.
Visibility: good. This is the most legitimate route there is - it exists to keep useful code alive - and it still puts a stranger's commit access on your site without telling you.
3. A committer quietly added
The plugin owner grants commit access to another account. No sale, no transfer, no change to the listed author. The original maintainer is still there and still in charge.
Visibility: poor, and this is the important one. Nothing on the directory page need change at all. The only evidence is a username appearing in the commit log that was never there before. It is also the route that most resembles a compromised maintainer account, because from the outside those two look identical.
4. The maintainer's company changes
The person is the same; the organisation behind them is not. An agency is acquired, a solo developer joins a company that takes over their plugins, a product is folded into somebody else's suite.
Visibility: mixed. The author string may change while the committers stay identical, or the reverse. Often the first public sign is a rebrand in the readme.
5. The maintainer walks away
Nobody takes over. Commits stop, the plugin keeps working, and it stays installed on every site that had it. There is no transfer here at all - which is exactly the problem, because an unmaintained plugin with an install base is what the buyers in route 1 go shopping for.
Visibility: good, if you are looking at dates. A plugin with no release in eighteen months is telling you something.
6. The account is compromised
Not a transfer, but indistinguishable from one at the moment it happens. The credentials of someone with commit access are stolen and used.
Visibility: depends entirely on whether the attacker commits under the existing account or adds a new one. If they use the existing account, no provenance signal moves at all - which is what happened with ShapedPlugin in June 2026, where the build pipeline itself was breached and the committer record looked completely normal throughout.
What this ordering is actually telling you
Routes 1, 2 and 4 are reasonably visible in public data. Route 5 is visible if you watch dates. Route 3 is visible only if you are comparing committer lists over time. Route 6 may not be visible at all.
So no amount of provenance monitoring gives you complete coverage, and anyone selling you that is overstating it. What it gives you is the four or five routes out of six where a public record does move - and in the April 2026 case, that record moved eight months before anyone noticed the payload.
What a site owner can do
- Know which plugins you would not notice losing. Those are the ones to remove. Every plugin is a standing grant of code execution to whoever holds commit access this week.
- Watch committers, not author names. The author string is a label. Commit access is the permission.
- Stage updates rather than applying them automatically on sites that matter. A delay of a few days costs little and is the only defence that also covers route 6.
- Treat premium plugins as unmonitorable, because they are. No public record exists to compare.