Someone purchased 30 WordPress plugins through a third-party vendor and planted identical backdoor payloads in every one of them. Same obfuscation patterns. Same C2 beaconing logic. Synchronized file modification timestamps across all versions. This was not 30 independent compromises. This was one operation. I know how this works because I've built operations like it. This is not a code review fai