Attacker Bought 31 WordPress Plugins, Hid a Backdoor for 8 Months, Then Activated It With an Ethereum C2

An attacker purchased a portfolio of 31 trusted WordPress plugins on a public marketplace, embedded a PHP backdoor in a routine-looking update, and left it dormant for eight months before activating it to distribute hidden SEO spam to thousands of websites — with the malware resolving its command-and-control server through an Ethereum smart contract to prevent traditional takedowns.

GLOBAL — A calculated supply chain attack on the WordPress plugin ecosystem has compromised thousands of websites and exposed a fundamental governance gap in one of the internet's most widely deployed platforms. The attack — fully documented by Anchor Hosting founder Austin Ginder, Patchstack, and TechCrunch — began not with a technical exploit but with a business transaction: the purchase of a 31-plugin portfolio called Essential Plugin on the Flippa marketplace in early 2025. The buyer, known only as "Kris," embedded a PHP backdoor in an August 2025 plugin update disguised as a WordPress 6.8.2 compatibility check, waited eight months, then activated it on April 5–6, 2026, distributing hidden SEO spam and fake pages to every affected website — visible only to search engine crawlers, invisible to site owners.

What Happened

The Acquisition and the Dormant Backdoor

The Essential Plugin portfolio was originally built by an India-based development team under the name WP Online Support, starting around 2015. By late 2024, declining revenue prompted founder Minesh Shah to list the entire portfolio on Flippa — a public marketplace for buying and selling online businesses. A buyer using the alias "Kris," with a background linked to SEO, crypto, and online marketing, purchased the portfolio for an undisclosed six-figure sum and inherited full SVN commit access to all 31 plugins on WordPress.org.

On August 8, 2025, Kris published version 2.6.7 of the plugins. The changelog read: "Check compatibility with WordPress version 6.8.2." In reality, the update added 191 lines of malicious PHP code to the class-anylc-admin.php file — a textbook PHP Object Injection via insecure deserialization, assembled across three coordinated components. A fetch_ver_info() method called file_get_contents() on the attacker's server and passed the response to @unserialize(). A version_info_clean() method then executed @$clean($this->version_cache, $this->changelog) — where all three values came from the unserialized remote data. An unauthenticated REST API endpoint with permission_callback: __return_true gave the attacker arbitrary function call capability from the internet, with no authentication required. This code sat completely inactive for eight months while sites continued to install and update the plugins normally.

Activation, Payload, and Blockchain C2

On April 5–6, 2026, the attacker activated the backdoor during a 6 hour 44 minute window between 04:22 and 11:06 UTC. The analytics module downloaded a malicious file designed to look like a legitimate WordPress component and injected code directly into wp-config.php — one of WordPress's most sensitive core files. The payload fetched spam links, redirects, and fake pages from a command-and-control server, then served them exclusively to Googlebot. A human visitor browsing any affected site would see a completely normal website while search engines received cloaked, malicious content designed to manipulate search rankings and monetize the attacker's SEO infrastructure.

To prevent traditional domain-based takedowns, the C2 server was resolved through an Ethereum smart contract querying public blockchain RPC endpoints. If a C2 domain was taken down, the attacker could simply update the smart contract to point to a new domain without modifying any plugin code — making the infrastructure effectively takedown-resistant through conventional means. This represents a meaningful escalation in supply chain attack sophistication, combining trusted plugin distribution with blockchain-anchored command infrastructure. Understanding how vulnerability management applies to third-party plugin ecosystems is increasingly critical as these attacks grow more sophisticated.

Scope and Impact

The Essential Plugin portfolio had over 400,000 declared plugin installs and more than 15,000 customers at the time of the attack. WordPress.org data showed approximately 20,000 active installations at the point of discovery. All sites running version 2.6.7 or later during the April 5–6 activation window should be treated as compromised until verified otherwise.

The incident did not occur in isolation. The same week saw a separate compromise of the Smart Slider 3 Pro plugin, which has over 800,000 active installations — through a different method involving a server breach rather than ownership transfer, but sharing the same root cause: implicit, unchecked trust in the official plugin update pipeline. WordPress.org currently lacks code signing for plugin updates and performs no security review of ownership transfers — a structural gap that this incident makes impossible to ignore.

This attack is part of a broader pattern of software supply chain attacks where trusted distribution channels are weaponized against the organizations that depend on them. The PyPI ecosystem faced a similar campaign just weeks earlier when a package with 1.1 million monthly downloads was hacked to push an infostealer.

Response and Attribution

WordPress.org's Plugins Team acted on April 7, permanently closing all 31 Essential Plugin plugins in a single day and pushing a forced update to version 2.6.9.1 that added return; statements to disable the phone-home functions. This stopped further distribution but did not remediate compromised sites — the malicious code injected into wp-config.php remained active on any site infected before the forced update ran, continuing to serve hidden spam to search engines.

Site owners who had any affected plugins installed during the April 5–6 window should: verify the size of wp-config.php against clean backup snapshots; search for the injected wpos-analytics module; check for wp-comments-posts.php — a malicious file placed to look like a core WordPress component; and test their site's behavior as seen by Googlebot specifically, not as a human visitor. Ginder has published a full list of affected plugins and a cleanup guide on the Anchor Hosting blog.

The CyberSignal Analysis

Signal 01 — Plugin Reputation Can Be Purchased

This attack demonstrates that a plugin's review history, install count, and age on the WordPress.org directory are not indicators of current safety — they are indicators of past safety, before ownership changed. A six-figure investment bought not just software assets but years of accumulated trust. For site owners, the practical implication is that plugin safety must be evaluated continuously, not at the point of initial installation. Monitoring for unexpected changes to core files like wp-config.php and maintaining off-site backup snapshots with adequate retention are not optional hygiene — they are the detection layer that caught this attack.

Signal 02 — Eight Months of Dormancy Is the New Attack Standard

The patience required to buy a portfolio, maintain legitimate updates for eight months, and activate the payload only after the ownership transition has faded from memory is a level of operational sophistication previously associated primarily with nation-state actors. The dormant period serves multiple purposes: it allows the installer base to grow after the ownership change; it reduces the likelihood that security researchers connect the timing of the malicious commit to the acquisition; and it allows trust to mature. Organizations and security tools that monitor only for immediate post-update anomalies will miss this class of attack entirely.

Signal 03 — WordPress's Governance Gap Is Now a Known Exploitable Attack Surface

The absence of ownership transfer review, cryptographic signing for plugin updates, or mandatory two-factor authentication for SVN commit access on WordPress.org is not a theoretical risk — it has now produced a documented, large-scale attack affecting tens of thousands of websites. This is the second known plugin hijack in a two-week period in April 2026. The attack model is viable, repeatable, and the infrastructure investment is within reach of well-funded criminal organizations. Until WordPress.org addresses these structural gaps, every site operator using plugins with automatic updates enabled is exposed to a risk they cannot fully control at the site level.

Sources