WordPress.org permanently shut down more than 30 plugins tied to the Essential Plugin publisher on April 7, 2026. According to a report by security researcher Austin Ginder, the backdoor had actually been introduced much earlier, on August 8, 2025, and stayed dormant for 243 days before activation. The affected plugin installs together totaled several million.
A first commit that added 191 lines of malicious code
The case traces back to WP Online Support, a team founded in 2015 by Minesh Shah and two others, later renamed Essential Plugin. Over a decade, the company built a portfolio of more than 30 WordPress plugins. The source material says revenue had fallen 35% to 45% from its peak by the end of 2024, after which the business was listed for sale on Flippa.
The buyer, identifying himself as “Kris,” had a background spanning SEO, cryptocurrency, and online gambling marketing. On August 8, 2025, version 2.6.7 was released with a changelog that only said “compatibility update.” The actual change was much larger: `class-anylc-admin.php` expanded from 473 lines to 664 lines, with the added 191 lines forming the backdoor. It was Kris’s first SVN commit after gaining access.
Dormant for eight months, then active in under seven hours
The code did not execute right away. It remained inactive until April 5-6, 2026, when the first stage began. A module called `wpos-analytics` sent a callback request to `analytics.essentialplugin.com` and downloaded a file named `wp-comments-posts.php`. The filename was crafted to resemble WordPress core file `wp-comments-post.php`, differing by a single letter.
Ginder’s timeline says the injection process began at 04:22 UTC on April 6, 2026. By 11:06 UTC, malicious code had been written into `wp-config.php` across victim sites worldwide. The full operation took 6 hours and 44 minutes, and the source says no platform-level alert was triggered during that window.
wp-config.php modified to deliver spam links and remote execution
The payload written into `wp-config.php` was about 6KB and carried two main functions. One was to insert spam outbound links, but only when the visitor matched Googlebot’s User-Agent. Regular users and site administrators would still see normal pages. The other was to expose an unauthenticated REST API endpoint using `permission_callback: __return_true`, then combine it with the PHP unserialization function `fetch_ver_info()` to create a remote path for arbitrary function calls.
No zero-day vulnerability was used in this incident. The report describes the backdoor code as fairly ordinary, without sophisticated obfuscation. Its success came from process gaps: the buyer acquired the plugins, obtained commit access, and pushed updates through standard channels.
Ethereum smart contract used as the C2 lookup layer
The most unusual technical detail involved command-and-control infrastructure. The attacker placed the logic for resolving the C2 domain inside an Ethereum smart contract, and infected sites queried public blockchain RPC nodes for the latest destination. That structure made standard domain blacklists and DNS blocking far less effective.
As described in the source, the operator could update the contract and switch the C2 target for all infected sites at once, without touching the controlled servers again. The design made cleanup harder. Still, the report argues that the contract architecture was not the reason the breach became possible; the deeper issue was the lack of review around plugin ownership changes on WordPress.org.
Old lessons resurfaced as WordPress.org removed the plugins
The article also points to a 2017 case in which Daley Tias bought the Display Widgets plugin for $15,000, with about 200,000 installs, and inserted loan-related spam links. That earlier incident spread to at least nine plugins. After that episode, WordPress.org did not introduce mandatory review for plugin ownership transfers, extra review for a new committer’s first submission, or notifications warning existing users that a plugin had changed hands.
On April 7, 2026, the WordPress.org plugin team permanently removed all related Essential Plugin listings in a single day. Austin Ginder’s confirmed list included at least 30 plugins such as Accordion and Accordion Slider, Popup Anything on Click, WP Slick Slider and Image Carousel, and WP Team Showcase and Slider.