Backdoored WordPress Plugin Abuses Remote Update Checker for Silent Code Delivery

A long-dormant backdoor has been uncovered in the “Quick Page/Post Redirect Plugin,” a popular WordPress add-on with over 70,000 active installations.

The tampered plugin, specifically version 5.2.3, contained two distinct malicious features.

First, it featured a passive content injection mechanism. On every page viewed by a logged-out user, the plugin connected to a third-party server (w.anadnet.com) and inserted hidden text into the website’s content.

Because this code only ran for logged-out visitors, site administrators never saw the injected content. This tactic, commonly known as parasite SEO, enabled the attackers to hijack search engine rankings in secret.

Second, the plugin contained an active backdoor that enabled remote code execution. It included a custom update checker library that forced the plugin to look for updates on anadnet.com instead of the official WordPress.org repository.

This allowed the remote server to install any code it wanted with full administrator permissions, completely hidden under the disguise of a routine plugin update.

Discovered by security researcher Austin Ginder, the compromised plugin used a rogue update server to silently deliver malicious code and inject hidden content into websites for over five years.

A Stealthy Supply Chain Attack

The timeline of this attack reveals a carefully planned supply-chain compromise carried out by the plugin’s author, who operates under the username “anadnet.”

In October 2020, the author added the rogue update checker to the official WordPress repository.

Months later, in February 2021, they quietly removed the custom updater from the main code. However, thousands of existing websites had already downloaded the code and were secretly pointing to the attacker’s server.

In March 2021, the attacker’s update server pushed the backdoored version 5.2.3 to those vulnerable sites.

While the command-and-control server eventually went offline, leaving the backdoor dormant, the malicious code remained permanently embedded on infected servers, waiting for the attacker to reactivate the domain.

The backdoor remained undetected for years because the version number on the infected sites (5.2.3) exactly matched the official WordPress.org version, even though the actual files were vastly different. Because the version strings matched, standard vulnerability scanners missed the threat.

To detect this tampering, administrators must verify file hashes. The most effective method is to use the built-in WordPress command-line tool (WP-CLI).

Running the command wp plugin verify-checksums quick-pagepost-redirect-plugin will compare the local files against the official WordPress.org records and flag any unauthorized changes.

If you are running the Quick Page/Post Redirect Plugin, security experts strongly advise uninstalling it immediately. Administrators should switch to actively maintained, secure alternatives like “Redirection” or “Safe Redirect Manager.”

Following Ginder’s threat intelligence report, the WordPress.org plugin review team officially closed the Quick Page/Post Redirect Plugin on April 14, 2026.

While new downloads are now blocked, the 70,000 existing installations remain at risk until site administrators manually remove the compromised software from their fleets.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.