Plugin installation is the process of adding a software extension to a WordPress site. Plugins can add features or change how the site works, and may receive broad access to site data and functions.
Because of this authority, installing a plugin is a security-sensitive action. Attackers who gain administrator access or abuse a trusted remote-management credential may install malicious plugins without exploiting WordPress core. Defenders should review plugin changes, use trusted and maintained software, and investigate unexpected installations alongside relevant account and management logs.