[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjwiyAmzuGJ00siPrue27h1HuVPxfyWHODuH0bSco_FI":3},{"article":4,"iocs":47,"watch_terms":55,"solutions":56,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8803354d-24e3-454e-b0fd-e103314ac686","WordPress plugin suite hacked to push malware to thousands of sites","wordpress-plugin-suite-hacked-to-push-malware-to-thousands-of-sites-05a385","More than 30 WordPress plugins in the EssentialPlugin package have been compromised with malicious code that allows unauthorized access to websites running them. [...]","More than 30 WordPress plugins in the EssentialPlugin package were compromised with malicious backdoor code planted in August 2025 following the project's acquisition. The backdoor remained dormant until recently activated to push malware via updates, generating spam pages and redirects while communicating with a C2 server using Ethereum-based address resolution for evasion. WordPress.org quickly disabled the plugins and forced updates to neutralize communication, but warned administrators that the malware may persist in core configuration files requiring manual cleanup.","Over 30 WordPress plugins in EssentialPlugin suite compromised with backdoor malware.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fwordpress-plugin-suite-hacked-to-push-malware-to-thousands-of-sites\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F15\u002FWordPress.jpg","2026-04-15T20:33:50+00:00","2026-04-15T22:00:19.982601+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"EssentialPlugin","product",{"name":21,"type":19},"WordPress",{"name":23,"type":24},"EssentialPlugins","vendor",{"name":26,"type":24},"WordPress.org",{"name":28,"type":24},"PatchStack",{"name":30,"type":24},"Anchor Hosting","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[48,52],{"type":49,"value":50,"context":51},"domain","analytics.essentialplugin.com","Malicious endpoint that returned serialized content to trigger backdoor execution",{"type":46,"value":53,"context":54},"wp-comments-posts.php","Backdoor file downloaded and injected into wp-config.php to enable remote access",[23,26,28],{"controls":57,"vendors":142},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"patch-management","Automated patch management","Known holes get closed in days, not months.",[63,70,78],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":59,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,126,134],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"wordpress-plugin-supply-chain-compromise-affects-thousands","WordPress Plugin Supply Chain Compromise Affects Thousands","The EssentialPlugin package compromise demonstrates how third-party software acquisitions can introduce severe security risks when proper due diligence isn't performed. The attackers planted dormant backdoor code that remained undetected for months before activation, highlighting the challenge of identifying supply chain threats. The use of Ethereum-based C2 communication shows sophisticated evasion techniques that traditional security tools may miss. This incident emphasizes the critical need for continuous monitoring of third-party components and having incident response procedures for supply chain compromises.",[148,149,150,151,152],"CIS Control 2","CIS Control 11","NIST SP 800-161","NIST IR-4","OWASP SCVS",{}]