optinmonster

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the vendor's official update system. The malware delivered this way installed a fake plugin that impersonates WooCommerce components, steals credentials, and grants operators remote file-writing capabilities. ShapedPlugin is a WordPress plugin vendor specializing in front-end/UI components and content display plugins, with a total active installation base of more than 400,000 for the free products. The security incident affected only three paid plugins: Product Slider Pro before 3.5.4 for WooCommerce, Real Testimonials Pro 3.2.5, and Smart Post Show Pro before 4.0.2. According to data WordPress security company Defiant collected from its WordFence firewall, the backdoor was injected into ShapedPlugin's Pro builds on May 21, and the first customer reports about potentially malicious updates emerged on June 10. The researchers confirmed the breach after downloading infected plugins from the ShapedPlugin site on June 12, and the publisher acknowledged the incident on June 16. “Our team immediately initiated an investigation upon identifying the concern, and we have already implemented the necessary measures to mitigate the issue,” ShapedPlugin told Wordfence. The publisher added that they were preparing updated plugin releases and validating them before pushing them to the update channels. Supply-chain compromise According to Wordfence’s analysis, the infected plugins contain a malicious loader file (LicenseLoader.php) that activates when a WordPress administrator accesses the website’s admin panel. It contacts the command-and-control (C2) server, downloads the second-stage (backdoor), installs it as a fake plugin (woocommerce-subscription or woocommerce-notification), reports to the attacker, and then self-deletes to erase evidence. The fake plugin, which is hidden from the WordPress plugin list, attempts to steal the following information on infected sites: WordPress login credentials (usernames, passwords, session cookies, user roles, IP addresses, and browser details) Two-factor authentication (2FA) secrets from popular WordPress security plugins Database credentials and WordPress authentication keys from wp-config.php Administrator account details SMTP/email service credentials WooCommerce order data from the past three months, including payment method information The researchers believe this was a build pipeline compromise, based on the file modifications, timestamp patterns suggesting automated injection, and Git build references contained in the packages. Also, releases hosted on WordPress.org were confirmed to be clean, suggesting that the attackers gained access to ShapedPlugin’s release infrastructure. WordPress is currently tracking the incident under CVE-2026-10735, while CVE-2026-49777 was also submitted as a duplicate. The ShapedPlugin compromise comes shortly after another major WordPress product, OptinMonster, was breached in a CDN supply-chain attack possible due to a flaw in a marketing server that allowed the hacker to steal credentials for a CDN account. In the ShapedPlugin case, though, the point of compromise appears to be the build pipeline. BleepingComputer has contacted the plugin vendor for a statement, and the company pointed us to the release of Real Testimonial Pro version 3.2.6, which lists a single fix described as “Fix: Some WPCS-related warnings.” ShapedPlugin also said that an official statement will be published after Wordfence's confirmation that the patches addressed the issue. According to Wordfence, fixes were made available on Product Slider Pro in version 3.5.4 and Smart Post Show Pro in version 4.0.2. If fake WooCommerce plugins are found, website administrators are recommended to reset all passwords on their sites, regenerate two-factor authentication (2FA) secrets, and review user lists for rogue additions. Update 07/07 - A ShapedPlugin spokesperson contacted us to share the below statement: "We confirm the incident. Attackers tampered with Pro builds distributed through our Easy Digital Downloads update channel (account.shapedplugin.com); the free WordPress.org versions were not affected." "The affected Pro products and corrected version boundaries are: Real Testimonials Pro — 3.2.4 and 3.2.5 compromised, 3.2.6 is the clean release; Product Slider Pro for WooCommerce — 3.5.2 compromised, 3.5.3 is the clean release; Smart Post Show Pro — 4.0.1 compromised, 4.0.2 the first clean release (current 4.0.5). Clean, verified versions of all three plugins are now live." "Since discovery we took the affected distribution infrastructure offline and rebuilt it, discontinued our GitHub-based release workflow pending a hardened redesign, migrated product-file storage to isolated AWS infrastructure separate from the site server, moved our stack to an xCloud-managed VPS with Patchstack protection and ongoing monitoring, performed a deep clean, and rotated credentials. On our own systems we have found no evidence that customer data was accessed, and continue to review. The malware's data-theft behavior applies to end-user sites that installed a tampered build; we proactively notified affected customers and are actively helping those who reached out to clean and secure their sites." Full per-product advisories with step-by-step remediation: Real Testimonials Pro: https://docs.shapedplugin.com/security-advisory-real-testimonials-pro-3-2-4-3-2-5-compromise/ Product Slider Pro for WooCommerce: https://docs.shapedplugin.com/woo-product-slider-pro-security-advisory/ Smart Post Show Pro: https://docs.shapedplugin.com/wordpress-security-advisory-smart-post-pro-4-0-1-compromise/ Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack impacting Awesome Motive's content distribution network (CDN). Of the three products, the OptinMonster lead-generation and conversion optimization platform is the most popular, with at least 1.2 million websites using it. E-commerce security firm Sansec discovered the attack over the weekend and found that malicious scripts were served to unsuspecting OptinMonster and TrustPulse users on Friday between 22:17 UTC and 22:42 UTC. PushEngage continued to serve malicious JavaScript code until 19:02 UTC on Saturday. The malware triggered only when a WordPress administrator visited a page on an infected website, collecting authentication tokens and nonces, and using them to create a rogue administrator account. The intruders then installed a self-hiding backdoor plugin and established a communication channel with a domain impersonating Tidio to send any newly captured data. The plugin also provided full remote access capabilities, including a web shell ("WPM File Manager & Shell") and arbitrary PHP code execution, granting attackers full control of compromised websites. “The operator rotates the plugin's disguise while keeping the logic byte-identical across renames,” Sansec says. “We have observed it shipping as "Content Delivery Helper" (content-delivery-helper, v2.7.1) and, currently, as "Database Optimizer" (database-optimizer, v2.9.4).” Awesome Motive published a security advisory earlier today about the incident, explaining that hackers gained access to a server in its environment after exploiting a known flaw in the UpdraftPlus WordPress plugin. This server hosted a marketing website and was not connected to the company’s production infrastructure or data systems; however, it hosted credentials for the company's CDN account, which the hackers stole. Using the stolen CDN API key, the attackers modified JavaScript files distributed via Awesome Motive's CDN, causing websites to silently load malicious code directly from the CDN. The affected files are: a.omappapi.com/app/js/api.min.js – OptinMonster a.opmnstr.com/app/js/api.min.js – OptinMonster a.optnmstr.com/app/js/api.min.js – OptinMonster a.trstplse.com/app/js/api.min.js – TrustPulse Awesome Motive reports that the malicious scripts were served for a short period on June 12 for OptinMonster and Trust Pulse, albeit not confirming the impact on PushEngage. “We have since remediated the marketing site, migrated it to a new server, and rotated all credentials, including the CDN API key,”Awesome Motive stated. The company also assured that its application servers, source code, and plugin hosting servers were not compromised. “Our application servers, our source code, and the systems that store your OptinMonster and TrustPulse account information are hosted separately and were not breached,” stated the publisher. “We have no evidence that account data or personal details held by us were accessed.” Site owners who might have been affected are recommended to: Check for, and remove rogue admin accounts ‘developer_api1’ or ‘dev_xxxxxx’ Inspect the filesystem directly under wp-content/plugins for hidden backdoor plugins Execute server-side malware scans Rotate administrator passwords, API keys, database credentials, and WordPress security salts. While the malicious content has been removed, the attacker continues to have access to compromised websites as long as the rogue administrator accounts and hidden backdoor plugins are still present. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Attackers have hijacked the code behind several popular WordPress plugins to plant hidden backdoors and rogue administrator accounts on as many as 1.2 million sites. The supply-chain attack, detailed by Dutch malware research firm Sansec on June 13, tampered with JavaScript served for OptinMonster, TrustPulse and PushEngage, three plugins run by WordPress vendor Awesome Motive. Rather than living on victim servers, the malicious code rode in through Awesome Motive's own delivery network, so any site loading the scripts pulled the tampered files straight from the source. The payload stays dormant until a logged-in administrator loads a page, leaving ordinary visitors untouched, for now. From Tampered Script to Rogue Admin When an admin is detected, the script springs into action. It creates a fresh administrator account, installs a self-hiding backdoor plugin to keep its grip, then ships the new credentials to a lookalike of the legitimate chat service tidio.com. OptinMonster alone runs on more than a million sites, with TrustPulse and PushEngage adding the rest. Because the attacker effectively owns each compromised site, Sansec warned that abuse of regular visitors is likely to follow. The firm likened the campaign to the 2024 Polyfill attack, in which poisoning a single upstream file affected thousands of downstream sites. How the attackers got in remains unclear: the firm said Awesome Motive's own servers, its CDN account or, less likely, the BunnyNet network behind it could be the entry point. A Short Exposure Window The exposure windows look short. Sansec logged the tampered OptinMonster and TrustPulse code for about half an hour late on June 12 before it disappeared, a hint the vendor had noticed, though the PushEngage script was still serving malware on June 13. Only the three plugins are confirmed compromised, yet Awesome Motive's reach runs far wider, spanning tens of millions of sites through products such as: WPForms, with more than six million installs All in One SEO, on around three million MonsterInsights, on roughly two million None of those is a confirmed hit, but Sansec urged anyone running an Awesome Motive plugin to watch for unfamiliar admin accounts and traffic to tidio[.]cc, and to act fast if either shows up. Infosecurity has reached out to Awesome Motive for comment.

An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way to break into the sites. When a site administrator was logged in as the file loaded, the code created an admin account under the attacker's control and installed a hidden plugin that opened a way back in. Ordinary visitors did not trigger it. Any site that was hit should be treated as compromised. All three plugins are run by one company, Awesome Motive, which had not commented on the two larger plugins as of June 15. Security firm Sansec disclosed the wider campaign on June 13, finding the same malicious code in JavaScript served for all three plugins. PushEngage followed a day later with its own incident notice, confirming an attacker had served tampered copies of its script and that sites loading them could be taken over. PushEngage, acquired by Awesome Motive years ago, is so far the only one of the three to issue guidance; OptinMonster and TrustPulse users have heard nothing official. The window was not the same for each plugin. Sansec saw the malicious code in OptinMonster and TrustPulse for only about 25 minutes on June 12, first around 22:17 UTC and gone by 22:42. PushEngage's exposure ran longer: several hours on June 12, and its script was still being served from some of the CDN's servers into June 14. So the two plugins with the most sites had the smallest window, and PushEngage had the largest. Sansec estimates that the three plugins reach more than 1.2 million sites between them, the bulk of that OptinMonster, which alone has over a million active installs. PushEngage's WordPress plugin has more than 9,000. That figure is reach, not damage: it counts sites that run the plugins, not sites that were broken into. How the attack worked The poisoned script did nothing on a normal page view. It acted only when a logged-in WordPress administrator loaded it, then used that admin's session to take over. That design is also why the WordPress dashboard cannot tell you whether you were hit: the backdoor is built to stay out of the admin screens, so the only reliable check is on the server itself. In PushEngage's case, the tampered files were its normal embeds, pushengage-web-sdk.js and pushengage-subscription.js, served from clientcdn.pushengage.com, the content-delivery network that pushes PushEngage's script out to customer sites. OptinMonster and TrustPulse were hit through separate Awesome Motive CDN endpoints. PushEngage says the rest of its systems were untouched: it found no sign that its main application or the servers holding customer data were reached. By PushEngage's own account, once the script ran with an administrator logged in, it: used that admin's session to act with full permissions, created a new admin account under the attacker's control, installed a plugin that does not show up in the dashboard, and sent the new login details and site information to tidio[.]cc, a fake domain made to look like the real tidio.com. Sansec found the same sequence across all three plugins. The tidio[.]cc domain was registered on April 28, weeks before the attack, which points to a planned operation rather than a quick smash and grab. The hidden plugin is the real prize. It opens what is known as a web shell, a remote command channel: anyone who knows the right URL can run code on the server without logging in. From there the attacker can read or change any file, copy the database, plant more backdoors, inject card-skimming code, redirect visitors, or steal data. The extra admin account is a simple way back in if you delete the plugin but miss the account. And because the attacker can run code freely, removing the named plugin and account may not be enough; both Sansec and PushEngage say to assume other backdoors could remain. How the attacker got in This is the part the two accounts disagree on. PushEngage says the attacker first broke into the server running its marketing website, through a known flaw in UpdraftPlus, a WordPress backup plugin. That server is separate from the systems that run the product and store customer data. What mattered was not the server itself but a key sitting on it: a CDN API key. With that key, the attacker did not need to break into PushEngage's main systems. It could simply change the files the CDN was already delivering to customer sites. Sansec is not convinced the entry point is settled. It says the breached system is still unknown, with Awesome Motive's own servers the most likely place, the CDN account possible, and the CDN provider, BunnyNet, unlikely. Sansec's public analysis does not examine or endorse the UpdraftPlus theory; that account comes from PushEngage alone, about its own environment. UpdraftPlus does have a separate authentication-bypass bug, CVE-2026-10795, that Wordfence rates 8.1 (high severity); it is now patched, and Wordfence has reported attacks against it, so anyone running UpdraftPlus should update no matter what. Whether that bug had anything to do with this break-in is unconfirmed. Treat the entry point as unsettled. What to check and do By Sansec's timeline, the OptinMonster and TrustPulse files were clean by June 13, while PushEngage's script lingered on some CDN servers into June 14. PushEngage says it is still working out the exact window and has since replaced the bad files, cleared the CDN cache, changed the CDN key and all related credentials, and moved the marketing site to new infrastructure. None of that cleans a site that was already taken over. Because the backdoor hides from the dashboard, you cannot rule out compromise by looking at WordPress. If your site ran any of the three plugins during the threat window, the only dependable answer is a server-side scan. Do not try to settle it by guessing whether you were logged in; most owners cannot prove that either way. Treat the steps below as the baseline. Run a server-side scan. Anyone who had PushEngage, OptinMonster, or TrustPulse active during the window should scan the server directly. A browser or dashboard check will miss a payload that only ran for logged-in admins. (Sansec saw the same payload on all three plugins, but has not confirmed OptinMonster and TrustPulse were delivered the same way or in the same window as PushEngage.) Check the filesystem, not the dashboard. Under wp-content/plugins, look for folders named content-delivery-helper ("Content Delivery Helper") or database-optimizer ("Database Optimizer"). Trust what is on disk. Delete any admin accounts you did not create, especially developer_api1 or anything matching dev_xxxxxx. Check your logs. Review web server access logs from June 12 to 14 UTC for outbound traffic to tidio.cc, including its /cdn-cgi/ paths, and to the attacker's server at 84.201.6.54. If you find anything, assume the worst. Rotate everything: admin passwords, API keys, database credentials, and the secret keys (salts) in wp-config.php. With code execution on the server, more persistence may remain.