Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites

An attacker served tampered JavaScript from CDNs used by the WordPress plugins PushEngage, OptinMonster, and TrustPulse that, when loaded by a logged-in administrator, created an attacker-controlled admin account and installed a hidden plugin providing a web-shell backdoor; Sansec and PushEngage confirmed the campaign, provided IoCs and remediation steps (server-side scans, credential rotation), and noted the likely use of a compromised CDN key or other server breach as the entry vector.