Compromised Awesome Motive CDN Backdoored WordPress Sites via Popular Plugins

Attackers tampered with JavaScript served from Awesome Motive infrastructure for the widely used WordPress plugins OptinMonster, TrustPulse, and PushEngage, triggering a supply-chain compromise that Sansec said exposed more than 1.2 million sites. The malicious code activated only when a logged-in WordPress administrator visited an affected site, then stole authentication data, exfiltrated site details to the typosquatted domain tidio.cc, created rogue administrator accounts, and deployed a stealth plugin designed to hide from normal WordPress administrative views.

Researchers said the hidden plugin provided unauthenticated remote code execution through a web shell and an eval-style endpoint, effectively giving attackers arbitrary PHP execution on compromised servers. Sansec verified malicious code in OptinMonster and TrustPulse CDN files beginning June 12 and said those paths were later cleaned, while some PushEngage CDN edges continued serving infected code until June 14; the exact initial compromise point remains unknown, but the distribution path ran through Awesome Motive-operated domains via BunnyNet CDN. Defenders were urged to treat any affected site with an administrator logged in during the exposure window as fully compromised, remove rogue users, search for hidden plugin directories, and rotate all administrator credentials and secrets.