Loading story…
The widely used WordPress plugin Quick Page/Post Redirect was found to contain a long-hidden backdoor that affected more than 70,000 sites through a covert self-update mechanism outside the normal WordPress.org review process. Researcher Austin Ginder traced the issue to versions 5.2.1 and 5.2.2, which contacted anadnet[.]com and later pulled a tampered 5.2.3 build from w.anadnet[.]com. The malicious code reportedly remained dormant for years and was designed to deliver arbitrary code or injected content to logged-out visitors while hiding activity from logged-in administrators.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
In April 2026, the WordPress plugin review team temporarily removed Quick Page/Post Redirect from the official directory after the backdoor was disclosed. Users were advised to uninstall compromised copies and replace them with a clean 5.2.4 release from WordPress.org once available.
Austin Ginder uncovered the supply-chain compromise after investigating security alerts on 12 infected sites and determined that the plugin had contained a dormant backdoor for years. His analysis found that the remote update mechanism could enable arbitrary code injection and potentially remote code execution if reactivated.
In March 2021, sites running affected versions reportedly received a malicious 5.2.3 update from w.anadnet[.]com. The build added a passive backdoor that hid activity from logged-in administrators while exposing malicious content to visitors and search engine crawlers, likely supporting parasite SEO.
Analysis of the plugin's history indicated that the Quick Page/Post Redirect plugin repository received a hidden self-update mechanism tied to anadnet[.]com in late 2020. This bypassed WordPress.org's normal update review path for versions 5.2.1 and 5.2.2.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceanchor.host
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain compromise of ShapedPlugin’s premium WordPress plugin distribution inserted backdoor code into official paid releases, allowing unauthenticated attackers to fully compromise affected websites. Wordfence said the attackers tampered with the vendor’s update pipeline used for Pro builds distributed via Easy Digital Downloads, while free versions in the WordPress repository were not affected. Confirmed malicious releases included **Smart Post Show Pro** `4.0.1`, **Product Slider for WooCommerce Pro** `3.5.2`, and **Real Testimonials Pro** `3.2.4`, which were later replaced by clean versions `4.0.2`, `3.5.3`, and `3.2.5`; the incident is tracked as **`CVE-2026-10735`** with a reported **CVSS 9.8**.
Jun 29, 2026
A supply-chain attack hit the **Essential Plugin** WordPress portfolio after the plugin business was reportedly acquired by a new owner who inserted a hidden backdoor into trusted add-ons used by thousands of websites. Researchers said the malicious code was added to `Countdown Timer Ultimate` version `2.6.7` in August 2025 as a PHP deserialization backdoor, then left dormant for about eight months before activating in early April 2026. Once triggered, affected sites contacted `analytics.essentialplugin.com`, received additional payloads, and had malicious code written into `wp-config.php`. The compromise allowed attackers to serve hidden spam links, fake pages, and redirects to Googlebot while remaining largely invisible to site owners. WordPress.org subsequently closed all **31** Essential Plugin entries in the plugin directory and pushed version `2.6.9.1` to remove the phone-home behavior, but reports warned that the update did **not** clean already-compromised `wp-config.php` files. Hosting providers and researchers urged administrators to manually inspect and remove any still-installed malicious plugins and persistence left on their servers, underscoring the risk that plugin ownership changes can turn established WordPress software into a malware distribution channel.
Jun 29, 2026
A malicious supply-chain backdoor was discovered in version `10.8.7` of the **Advanced Responsive Video Embedder** WordPress plugin, tracked as **`CVE-2026-18072`** with a **CVSS 9.8** rating. The implanted code introduced an unauthenticated authentication bypass through the `_wplogin` and `_wpm` parameters, allowing an attacker to use a hardcoded token from the plugin source to log in as any existing administrator and take full control of a site. The flaw has been classified as **`CWE-506: Embedded Malicious Code`**, and reporting indicates the backdoor was likely added after an attacker gained commit access to the developer account. Wordfence said it detected the malicious release within hours of its introduction and alerted the WordPress.org plugin team, which closed the plugin repository for downloads the same day. Additional reporting said the backdoor also created a persistent admin session, redirected the intruder into the WordPress dashboard, and sent the compromised site URL and impersonated administrator username to attacker-controlled domain `fontswp.com`. The plugin had roughly **20,000 active installations**, although WordPress.org said the malicious version had not been widely distributed through automatic updates; defenders were urged to remove version `10.8.7`, install a clean update, and investigate affected sites for signs of compromise.
Jul 31, 2026