As cited
Copy frozen at (site build).
breaches incidents
Critical Supply Chain Compromise on 20+ Plugins by EssentialPlugin
A malicious actor acquired EssentialPlugin, a WordPress plugin vendor, and planted PHP object injection backdoors across 20+ plugins with hundreds of thousands of active installations. The backdoor remained dormant for seven months until April 5, 2026, when the attacker activated it by serving malicious serialized payloads to trigger arbitrary file writes on affected sites. WordPress Plugin Review removed the gadget chain code, forced security updates across all affected plugins, and permanently closed them from the directory.
Why it matters: WordPress site administrators running any EssentialPlugin plugin need to update immediately to remove the backdoor, as the compromise affected plugins with up to 30,000+ active installations and could enable full server compromise through arbitrary file write.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
breaches incidents
Critical Supply Chain Compromise on 20+ Plugins by EssentialPlugin
A malicious actor acquired EssentialPlugin, a WordPress plugin vendor, and planted PHP object injection backdoors across 20+ plugins with hundreds of thousands of active installations. The backdoor remained dormant for seven months until April 5, 2026, when the attacker activated it by serving malicious serialized payloads to trigger arbitrary file writes on affected sites. WordPress Plugin Review removed the gadget chain code, forced security updates across all affected plugins, and permanently closed them from the directory.
Why it matters: WordPress site administrators running any EssentialPlugin plugin need to update immediately to remove the backdoor, as the compromise affected plugins with up to 30,000+ active installations and could enable full server compromise through arbitrary file write.
- Source published
- First seen by Cybersecurity Tracker