Someone bought 30 WordPress plugins and planted backdoors in all of them

A supply chain attack that began with the WordPress plugin Countdown Timer Ultimate was repeated on a much larger scale. After a new owner acquired an existing, trusted plugin portfolio, evidence emerged that backdoors had been planted in multiple plugins.

At the core was the wpos-analytics module. This module connected to analytics.essentialplugin.com and downloaded a file called wp-comments-posts.php, which was used to inject large amounts of PHP code into wp-config.php. The injected code pulled spam links, redirects, and fake pages from a C2 server, and was designed to serve malicious content only to Googlebot.

Even more dangerous, the C2 address was resolved via an Ethereum smart contract. Simple domain blocking is not enough to counter this, and if the attacker changes the contract's content, the command server can easily be swapped out.

WordPress.org pushed a forced update to v2.6.9.1, blocking the phone-home functionality, but could not clean up wp-config.php, which was already compromised. By comparing backups, the author narrowed down the injection timing to a 6-hour-44-minute window around April 6, 2026.

Tracing further, the backdoor was planted in v2.6.7, released on August 8, 2025, while actual exploitation didn't begin until 8 months later, on April 5-6, 2026. The problematic code processed deserialized remote responses using @unserialize(), and even left open an unauthenticated REST API endpoint with permission_callback: __return_true.

Behind this was the sale of the plugin business via Flippa. The original team operated more than 30 free plugins under the names WP Online Support / Essential Plugin, but after revenue declined, the entire business was sold—and the most shocking part is that the new owner's very first SVN commit was the backdoor itself.

On the same day, WordPress.org permanently closed 31 plugins. The article lists the affected plugin slugs and warns that anyone running these plugins on their own sites should remove or patch them, and in particular must check whether wp-config.php has been tampered with.