Backdoors Found in Multiple WordPress Plugins After Ownership Change

Wed, 15 Apr 2026 00:51:00 +0200

Dozens of WordPress plugins have been removed from the official directory after security researchers uncovered backdoors added to their source code. The discovery came to light after Anchor Hosting founder Austin Ginder investigated suspicious activity linked to a company called Essential Plugin, which manages several popular WordPress extensions. According to Ginder, Essential Plugin was acquired last year, and soon after the purchase, a hidden backdoor was inserted into the affected plugins. This malicious code remained inactive until earlier this month, when it began pushing harmful scripts to any websites using the compromised plugins. Essential Plugin claims its products have over 400,000 total installations and 15,000 customers, with WordPress data listing around 20,000 active installations affected.

The incident highlights a growing supply chain security risk — malicious actors acquiring legitimate software or plugins to exploit their user base. Since WordPress does not alert w