Backdoored Essential Plugin WordPress Add-ons Compromised Thousands of Sites

A supply-chain attack hit the Essential Plugin WordPress portfolio after the plugin business was reportedly acquired by a new owner who inserted a hidden backdoor into trusted add-ons used by thousands of websites. Researchers said the malicious code was added to Countdown Timer Ultimate version 2.6.7 in August 2025 as a PHP deserialization backdoor, then left dormant for about eight months before activating in early April 2026. Once triggered, affected sites contacted analytics.essentialplugin.com, received additional payloads, and had malicious code written into wp-config.php.

The compromise allowed attackers to serve hidden spam links, fake pages, and redirects to Googlebot while remaining largely invisible to site owners. WordPress.org subsequently closed all 31 Essential Plugin entries in the plugin directory and pushed version 2.6.9.1 to remove the phone-home behavior, but reports warned that the update did not clean already-compromised wp-config.php files. Hosting providers and researchers urged administrators to manually inspect and remove any still-installed malicious plugins and persistence left on their servers, underscoring the risk that plugin ownership changes can turn established WordPress software into a malware distribution channel.