OptinMonster Plugin Vulnerability Exposes 1.2 Million WordPress Sites to Cyberattacks

A large-scale supply chain attack targeting the popular OptinMonster WordPress plugin has exposed more than 1.2 million websites to active compromise.

The campaign also affects the TrustPulse and PushEngage plugins, both developed by Awesome Motive, significantly amplifying the attack surface across millions of WordPress deployments.

The attackers tampered with legitimate JavaScript files delivered via Awesome Motive’s CDN infrastructure, allowing malicious code to be silently injected into downstream websites without directly breaching individual servers.

This technique mirrors the 2024 Polyfill supply chain attack, where a single upstream compromise enabled mass exploitation at scale.

OptinMonster Plugin Vulnerability

The injected JavaScript payload is highly selective and designed to evade detection. It activates only when a logged-in WordPress administrator accesses the site, bypassing regular visitors and automated analysis environments such as headless browsers.

Once triggered, the malware performs environment checks, identifies WordPress paths, extracts REST and AJAX nonces, and creates unauthorized administrator accounts using multiple fallback mechanisms, including REST API endpoints and traditional admin workflows.

Notably, it plants a fixed administrator account (developer_api1) alongside randomized dev_xxxxxx accounts, ensuring persistence even if one vector fails.

Following account creation, the malware deploys a stealthy backdoor plugin that hides itself from both the WordPress dashboard and REST API endpoints.

This plugin enables full remote code execution via unauthenticated access, exposing endpoints that allow attackers to execute system commands and arbitrary PHP code, according to research published by the Sansec Forensics Team on June 13, 2026.

The payload also exfiltrates newly created credentials and site metadata using XOR encryption and base64 encoding, transmitting the data to a command-and-control (C2) infrastructure hosted at tidio.cc, a domain impersonating the legitimate tidio.com service.

Data exfiltration mechanisms include multiple fallback channels such as sendBeacon, fetch requests, XMLHttpRequest, and image beacons to ensure delivery reliability.

Security researchers confirmed active exploitation in the wild, with Patchstack reporting over 270 attempts to create rogue admin accounts across compromised sites within 48 hours.

The majority of these attempts leveraged the WordPress REST API, aligning with the malware’s execution logic. The attack infrastructure was operational before exploitation, with the malicious domain registered in April 2026 and linked to hosting provider Ultahost.

The infection window appears to have begun on June 12, 2026, with malicious scripts persisting on some CDN edges until June 14.

Awesome Motive has acknowledged the incident and attributed the breach to a compromised CDN API key obtained through exploitation of a vulnerability in the UpdraftPlus plugin on an internal system.

The company has since revoked compromised credentials, purged CDN caches, and migrated affected infrastructure. However, due to the nature of the attack, any site that loaded the malicious script while an administrator was logged in is considered compromised.

Security experts warn that remediation requires more than plugin updates. Affected site owners must audit administrator accounts, remove unauthorized users, and scan server-side files for hidden plugins, particularly those masquerading as legitimate utilities.

Full credential rotation and incident response procedures are strongly recommended, as attackers may already have achieved persistent access and code-execution capabilities.

Indicators of Compromise (IOCs)

Category	Indicator	Details
C2 Domain	tidio.cc	Malicious command-and-control domain
C2 IP	84.201.6.54	Hosted on Ultahost (AS214036)
C2 Endpoint	tidio.cc/cdn-cgi/p	Data exfiltration (OptinMonster/TrustPulse)
C2 Endpoint	tidio.cc/cdn-cgi/b	Data exfiltration fallback
C2 Endpoint	tidio.cc/cdn-cgi/l	Payload generation
C2 Endpoint	tidio.cc/cdn-cgi/pe-p	Data exfiltration (PushEngage variant)
C2 Endpoint	tidio.cc/cdn-cgi/pe-b	Data exfiltration fallback
C2 Endpoint	tidio.cc/cdn-cgi/pe-l	Payload generation
XOR Key	jX9kM2nP4qR6sT8v	Used for encoding stolen data
Backdoor Marker	WPM File Manager & Shell	Malicious web shell interface
Rogue Admin	developer_api1	Fixed attacker-created admin account
Rogue Email	customer1usx@gmail.com	Linked to fixed admin account
Rogue Pattern	dev_xxxxxx	Randomized admin usernames
Rogue Email Pattern	dev_xxxxxx@gmail.com	Randomized attacker emails
Malicious Plugin	content-delivery-helper	Disguised plugin (v2.7.1)
Malicious Plugin	database-optimizer	Disguised plugin (v2.9.4)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.