# Display Widgets (2017): what Health Score would have shown Published November 5, 2026 **Short answer.** The plugin changed hands on 19 May 2017. On the same day its readme replaced the only listed contributor, `sswells`, with a new account, `displaywidget`, and Health Score would have emailed that change. The first malicious version shipped about a month later, on 21 June 2017. ## What happened From [SecurityWeek](https://www.securityweek.com/backdoored-plugin-impacts-200000-wordpress-sites) and [Wordfence](https://www.wordfence.com/blog/2017/09/display-widgets-malware/): Date Event 19 May 2017 The author sells Display Widgets for $15,000. 21 Jun 2017 Version 2.6.0 downloads a 38 MB database from an outside server. Removed from WordPress.org two days later. 30 Jun 2017 Version 2.6.1 adds a file that lets the new owner publish, change and delete content on every site running it, hidden from logged-in users. 1 Jul, 24 Jul, 8 Sep 2017 WordPress.org removes the plugin three more times. About 200,000 sites were affected. ## What Health Score would have shown We replayed the plugin’s public Subversion history (113 commits, 84 readme versions) through Health Score’s own code, for a site that had it installed from 1 November 2016. When What the site owner would have seen 1 Nov 2016 Grade **Watch** (50): no release for a year, “tested up to” three WordPress versions behind. 19 May 2017 Email: “contributors changed on WordPress.org. Added: displaywidget. Removed: sswells.” 20 Jun 2017 Another contributor alert. Grade goes **up** to Healthy (90). An archived copy of the plugin page from 23 May 2017 already lists `displaywidget` as the contributor, which matches the replay. ## What it would have missed - **The malicious code.** Health Score does not read code. - **The grade went the wrong way.** The new owner’s releases updated “tested up to” and the release date, so the plugin looked better maintained than it had in years. Longevity data rewards an active owner, even a bad one. That is why the change of hands is an alert of its own and not just a score. - **The removals.** WordPress.org removed the plugin four times in 2017. Today its API only reports a plugin’s latest status, and the web archives hold no copies of the closed page from those weeks, so the replay cannot show those alerts. The dates in the table above come from the press reports. - **The owner field.** It cannot be replayed either: there are no archived WordPress.org API answers for this plugin. ## How we tested The method is the same as the [Essential Plugin replay](https://plugevity.com/cases/essential-plugin-backdoor/). Each day’s WordPress.org answer is rebuilt from the public Subversion history and passed through Health Score’s own classes. Support-forum data is not available historically and is left out. ## Questions ### What happened to the Display Widgets plugin? Its author sold it in May 2017. The new owner's updates, starting with version 2.6.0 in June 2017, added code that let them publish content on the sites running it and hide it from logged-in users. WordPress.org removed the plugin four times between June and September 2017. About 200,000 sites were affected, according to SecurityWeek. ### Would Health Score have warned about Display Widgets? In a replay of the plugin's public history, Health Score would have emailed on 19 May 2017 that the plugin's only listed contributor had been replaced by a new account, about a month before the first malicious version. It would not have detected the malicious code itself. ## The plugins in this case [Health Score](https://plugevity.com/plugins/health-score/): Know which of your plugins are built to last. [All case studies](https://plugevity.com/cases/) --- Source: https://plugevity.com/cases/display-widgets-2017/