WordPress plugin suite hacked to push malware to thousands of sites

More than 30 WordPress plugins in the EssentialPlugin package were compromised after an acquisition, with a backdoor present since August 2025 that was recently activated to fetch and inject malware (via a downloaded `wp-comments-posts.php` payload that modifies `wp-config.php`). The malware uses Ethereum-based C2 address resolution, selectively serves spam/redirects to Googlebot, and affected plugins have hundreds of thousands of active installations; WordPress.org forced updates to disable communication but warned infected `wp-config.php` files may remain.