A significant WordPress plugin hack has compromised more than 30 plugins in the EssentialPlugin suite. Malicious code now allows unauthorized access to thousands of websites running these popular extensions.

The backdoor was planted in August 2025 but remained dormant until recently. Attackers activated the malware through plugin updates, which generated spam pages and triggered redirects based on commands from a control server. The breach affects plugins with hundreds of thousands of active installations across the WordPress ecosystem.

How the WordPress Plugin Hack Was Discovered

Austin Ginder, founder of Anchor Hosting, uncovered the security breach after receiving a tip about suspicious code. His investigation revealed that the backdoor appeared in all EssentialPlugin products following a six-figure acquisition in August 2025.

EssentialPlugin, originally founded as WP Online Support in 2015, operates as a WordPress development company. The firm offers sliders, galleries, marketing tools, WooCommerce extensions, and SEO utilities. The company rebranded to its current name in 2021.

According to Ginder, the dormant backdoor recently activated and contacted external infrastructure. It downloaded a file called ‘wp-comments-posts.php’ that injected malware into the critical ‘wp-config.php’ file. This configuration file connects WordPress sites to their databases and stores essential settings.

Technical Details of the Malware Operation

The malware operates with sophisticated stealth capabilities. It remains invisible to site owners while targeting search engine crawlers specifically. The code uses Ethereum-based command-and-control address resolution to evade detection.

“The injected code was sophisticated. It fetched spam links, redirects, and fake pages from a command-and-control server,” Ginder explained. “It only showed the spam to Googlebot, making it invisible to site owners.”

Security researchers at PatchStack analyzed the backdoor’s operation. They found that the malware activated only when the ‘analytics.essentialplugin.com’ endpoint returned malicious serialized content. This conditional execution helped the attack remain undetected for months.

WordPress.org Response and Security Measures

WordPress.org acted quickly after receiving reports of the malicious activity. The platform closed access to the compromised plugins and pushed a forced update to affected websites. This emergency update neutralized the backdoor’s communication channels and disabled its execution path.

However, the WordPress.org Plugins Team issued an important warning. The forced update did not clean the wp-config core configuration file. Site administrators must manually inspect and clean this critical file to fully remove the infection.

The security team also cautioned that while wp-comments-posts.php represents one known backdoor location, the malware may hide in additional files. The malicious filename closely resembles the legitimate wp-comments-post.php file, making detection more challenging.

What WordPress Site Owners Should Do Now

Website administrators running EssentialPlugin products need to take immediate action. First, verify that the forced security update from WordPress.org has been applied. Then, manually inspect the wp-config.php file for unauthorized code injections.

Site owners should also scan their entire WordPress installation for suspicious files. Look specifically for files with names similar to legitimate WordPress core files. Additionally, check for unusual outbound connections to unfamiliar domains.

Consider implementing a WordPress security plugin that monitors file changes and unusual activity. Regular backups become critical in situations like this, allowing for quick restoration if malware persists. Review server logs for any suspicious access patterns or unauthorized administrative actions.

The Broader WordPress Security Implications

This WordPress plugin hack highlights vulnerabilities in the plugin ecosystem. When developers acquire established plugins, the new ownership creates potential security risks. Users often trust plugins based on historical reputation without considering ownership changes.

The incident demonstrates how attackers can compromise supply chains through legitimate update mechanisms. By inserting backdoors during the development process, malicious actors bypass traditional security measures. Site owners must remain vigilant even when using established, popular plugins.

WordPress.org continues to monitor the situation and may release additional guidance. The platform’s quick response prevented more widespread damage. However, the breach serves as a reminder that no plugin ecosystem remains completely immune to sophisticated attacks.

EssentialPlugin has not responded to requests for comment regarding the malicious code insertion. The timing of the backdoor’s appearance immediately following the company’s acquisition raises questions about the new owner’s security practices and code review processes.

Original Source: www.bleepingcomputer.com