Supply Chain Attack Hits Popular WordPress Plugins Through Awesome Motive CDN

A supply chain attack compromised the Awesome Motive CDN, injecting malicious JavaScript into files served by popular WordPress plugins OptinMonster, TrustPulse, and PushEngage. The injected code targeted logged-in WordPress administrators to create backdoor accounts and install a stealthy backdoor plugin that hides from the admin UI and allows remote code execution. The attack affected sites loading the compromised CDN scripts, exposing potentially millions of WordPress installations. The malicious activity was active briefly in June 2026 before cleanup, but the backdoor presence requires manual detection and remediation.

• securityaffairs.com/193616/malware/supply-chain-attack-hits-popular-wordpress-plugins-through-awesome-motive-cdn.html (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1u6e1fi/supply_chain_attack_hits_popular_wordpress/ (opens in a new tab)

• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malwareCampaign2026-09-17
• Published research article on IEEE about supply chain attacks and preventive security measuresTool2026-07-17
• Safer-dependencies: A toolkit for claude code to ensure dependencies used aren't vuln, don't use abandoned packages, implement cooldown to avoid supply chain attacks, etc...News2026-07-07
• From package to postinstall payload: Inside the Mastra npm supply chain compromiseMalware2026-06-18