BreachPublished 15 Jun 2026

OptinMonster WordPress plugin hacked in CDN supply-chain attack

Source Bleeping Computer

Description

WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack impacting Awesome Motive-s content distribution network (CDN). [...]

Impact

The attack allows adversaries to gain full administrative control over affected WordPress sites by creating rogue admin accounts and installing stealth backdoors. This enables remote code execution and persistent access, potentially leading to site defacement, data theft, or further compromise. Although the CDN and marketing server were compromised, Awesome Motive's core application servers and user data were not breached. The impact is limited to sites using the affected plugins during the attack window and not remediated by site owners.

Defensive guidance

Awesome Motive has remediated the marketing server, migrated it to a new server, and rotated all credentials including the CDN API key. Site owners should check for and remove rogue administrator accounts named 'developer_api1' or 'dev_xxxxxx', inspect the wp-content/plugins directory for hidden backdoor plugins, perform server-side malware scans, and rotate administrator passwords, API keys, database credentials, and WordPress security salts. Removing the malicious scripts from the CDN has been completed, but compromised sites remain at risk until rogue accounts and backdoors are fully removed.

Summary

Attackers exploited a known flaw in the UpdraftPlus WordPress plugin to gain access to a marketing server hosting credentials for Awesome Motive's CDN. Using stolen CDN API keys, they injected malicious JavaScript into files distributed via the CDN for the OptinMonster, TrustPulse, and PushEngage plugins. The malicious scripts executed when WordPress administrators visited infected sites, harvesting authentication tokens and nonces to create rogue administrator accounts and install self-hiding backdoor plugins. These backdoors provide full remote access, including a web shell and arbitrary PHP code execution. Awesome Motive confirmed that their application servers and source code were not compromised and have remediated the marketing server and rotated all credentials. The attack window was brief, with malicious scripts served on June 12, 2026. However, compromised sites remain vulnerable if rogue accounts and backdoors are not removed.

References

bleepingcomputer.com/news/security/optinmonster-wordpress-plugin-hacked-in-cdn-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Jun 2026, 17:45 UTC

References

Community reviews