Trusted WordPress Plugins Hijacked in 8-Month Stealth Backdoor Campaign

A threat actor who purchased the Essential Plugin portfolio inserted an unserialize-based RCE backdoor into 30+ widely used WordPress plugins in August 2025; the backdoor stayed dormant until April 2026 when it fetched payloads that injected malicious PHP into wp-config.php and served cloaked SEO spam and redirects (visible only to Googlebot) from a C2 infrastructure that used an Ethereum smart contract for domain resolution. WordPress.org force-pushed updates to disable the plugin phone-home behavior on discovery, but many sites remain persistently infected until wp-config.php is manually cleaned, making this a large-scale supply-chain compromise affecting hundreds of thousands of sites.