31 WordPress Plugins Compromised via Portfolio Acquisition

A malicious actor compromised 31 popular WordPress plugins by purchasing their developer portfolio and embedding backdoor code, exposing thousands of websites to hidden spam campaigns that targeted search engine crawlers. The attack, which originated in August 2025 and activated in early April 2026, affected plugins with more than 400,000 total installations and over 20,000 active sites, according to data from the WordPress repository.

The breach came to light when Austin Ginder, founder of managed WordPress hosting provider Anchor Hosting, received a tip from a client about suspicious activity in the Countdown Timer Ultimate plugin. Ginder's investigation revealed that the entire Essential Plugin portfolio, which includes tools for sliders, galleries, testimonials, FAQs, and WooCommerce extensions, had been altered after its acquisition. Established in 2015 as WP Online Support and rebranded in 2021, the portfolio was sold in early 2025 through Flippa, an online marketplace for digital assets, to a buyer using the alias Kris for a six-figure sum. The buyer, whose background includes SEO, cryptocurrency, and online gambling, introduced the backdoor in plugin version 2.6.7 on...