WordPress plugin suite hacked to push malware to thousands of sites
Over 30 WordPress plugins in EssentialPlugin suite compromised with backdoor malware.
More than 30 WordPress plugins in the EssentialPlugin package were compromised with malicious backdoor code planted in August 2025 following the project's acquisition. The backdoor remained dormant until recently activated to push malware via updates, generating spam pages and redirects while communicating with a C2 server using Ethereum-based address resolution for evasion. WordPress.org quickly disabled the plugins and forced updates to neutralize communication, but warned administrators that the malware may persist in core configuration files requiring manual cleanup.
AI summary of the linked source. Not reviewed by an editor. How this works
Run EssentialPlugins?
Get an email when a new story names EssentialPlugins, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe EssentialPlugin package compromise demonstrates how third-party software acquisitions can introduce severe security risks when proper due diligence isn't performed. The attackers planted dormant backdoor code that remained undetected for months before activation, highlighting the challenge of identifying supply chain threats. The use of Ethereum-based C2 communication shows sophisticated evasion techniques that traditional security tools may miss. This incident emphasizes the critical need for continuous monitoring of third-party components and having incident response procedures for supply chain compromises.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — analytics.essentialplugin.com
- malware — wp-comments-posts.php