EssentialPlugin WordPress Plugins Backdoored to Deliver Malware to Sites
Summary
More than 30 EssentialPlugin plugins carried a backdoor added after an August 2025 acquisition. Activated code fetched malware that modified wp-config.php and served Googlebot-targeted spam and redirects. WordPress.org disabled the plugins, but existing infections may.
Key points
- More than 30 EssentialPlugin plugins were found to contain backdoor code introduced after the project was acquired in August 2025.
- The dormant backdoor was activated to fetch wp-comments-posts.php, which injected malware into wp-config.php.
- The malware used Ethereum-based C2 address resolution and selectively showed spam, redirects, and fake pages to Googlebot.
- PatchStack analysis found the backdoor depended on a malicious response from analytics[.]essentialplugin[.]com.
- WordPress.org disabled the plugins and pushed a forced update to disable the backdoor’s execution path.
- The forced update did not clean wp-config.php, and administrators were warned malware could be hidden in other files.
Article Details
- Victim Organization
- Websites running EssentialPlugin plugins; specific affected organizations are not identified
- Incident Type
- Compromise of WordPress plugins through a backdoor, followed by malware delivery, spam pages, and redirects
- Operational Impact
- The backdoor could inject malware into wp-config.php and serve spam pages, redirects, and fake pages selectively to Googlebot. WordPress.org disabled the plugins and pushed a forced update, but the update did not clean wp-config.php or rule out malware in other files.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | analytics[.]essentialplugin[.]com | The backdoor worked only when this endpoint returned malicious serialized content, according to PatchStack's analysis. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe activated backdoor fetched wp-comments-posts.php, which injected malware into wp-config.php.T1195.002 · Compromise Software Supply ChainBackdoor code was introduced into the EssentialPlugin package after its acquisition and later distributed to users through plugin updates, consistent with a software supply-chain compromise.
People
Vendors
Anchor Hostinginstallations and was spotted by Austin Ginder, the founder of managed WordPress hosting provider Anchor Hosting, after receiving a tip about one add-on containing code that allowed third-party access.EssentialPluginMore than 30 WordPress plugins in the EssentialPlugin package were found to contain a backdoor that allows unauthorized access to sites using them.PatchstackAnalysis from WordPress security platform PatchStack shows that the backdoor worked only if the ‘analytics.essentialplugin.com’ endpoint returned with a malicious serialized content.
Products
EssentialPluginMore than 30 WordPress plugins in the EssentialPlugin package were found to contain a backdoor that allows unauthorized access to sites using them.WordPressMore than 30 WordPress plugins in the EssentialPlugin package were found to contain a backdoor that allows unauthorized access to sites using them.