Attackers compromised the Awesome Motive CDN, which serves JavaScript files for WordPress plugins OptinMonster, TrustPulse, and PushEngage. The malicious JavaScript was injected directly into the CDN-served files, affecting all sites loading these scripts without modifying victim servers. The payload activates only for logged-in WordPress administrators, harvesting authentication tokens and fingerprinting the WordPress version. It creates backdoor admin accounts using multiple fallback methods and installs a hidden backdoor plugin that evades detection by hiding from plugin lists and REST API endpoints. The backdoor plugin exposes unauthenticated web shells and PHP eval execution. Data exfiltration is done via multiple fallback network methods to a C2 domain impersonating a legitimate chat service. The attack was discovered by Sansec researchers in June 2026, with the malicious code active for a short window. No official vendor advisory or patch information is provided. Manual detection and removal of backdoor accounts and hidden plugins are necessary.

The attack compromises the integrity and security of WordPress sites using the affected plugins by injecting backdoors that allow persistent unauthorized access and remote code execution. The malicious code bypasses normal detection by hiding from the WordPress admin interface and REST API. Stolen credentials and site information are exfiltrated to an attacker-controlled domain. The scale of impact is large due to the widespread use of the affected plugins, potentially affecting millions of sites. If an admin was logged in during the injection window, the site is likely compromised. The attack undermines trust in the plugin supply chain and CDN security.

No official patch or fix has been confirmed from the vendor. Site administrators should immediately check for unauthorized admin accounts named developer_api1 or dev_xxxxxx and remove them. Inspect the wp-content/plugins directory directly for hidden plugins named content-delivery-helper or database-optimizer, as these will not appear in the admin dashboard. Rotate all admin passwords and secrets. Assume full compromise if indicators of compromise are found and perform thorough server-side scanning. Monitor network traffic for connections to tidio.cc or similar suspicious domains. Await official communication from Awesome Motive for further guidance.