Anatomy of a WordPress.org supply-chain attack: the six ways in

Six ways an attacker turns a trusted WordPress.org plugin into a foothold on your site, each drawn from a real campaign I have traced, with the code that made it work. Plus the one method you cannot scan for, and what actually catches all of them.