CDN supply chain attack compromises three WordPress plugins

A supply chain attack has compromised three popular WordPress plugins, potentially allowing attackers to take control of websites that use them. The attack, discovered by the ecommerce security firm Sansec, targeted OptinMonster, TrustPulse, and PushEngage, all operated by the WordPress vendor Awesome Motive. The malicious code was injected into JavaScript files served directly from Awesome Motive's content delivery network (CDN), meaning affected websites unknowingly loaded the tampered scripts.

The attack was operational for a short period beginning on June 12. Malicious scripts were served to OptinMonster and TrustPulse users for approximately 25 minutes between 22:17 UTC and 22:42 UTC that day. The PushEngage script continued to serve malicious code until late on June 14. The malware was designed to trigger only when a logged-in WordPress administrator visited a page on an infected site. Upon detection, the script would harvest authentication tokens and use them to create a new, hidden administrator account under the attacker's control.

The attackers then installed a self-hiding backdoor plugin that provides full remote access to the compromised website. This plugin, which...