Massive WordPress Supply Chain Attack Exposes 1.2 Million Sites Security researchers at Sansec uncovered a large-scale supply chain attack targeting widely used WordPress plugins, exposing over 1.2 million websites to potential compromise. The campaign, active in recent weeks, involved malicious code injected into JavaScript files distributed via Awesome Motive’s CDN, affecting plugins like OptinMonster, TrustPulse, and PushEngage with OptinMonster alone installed on over one million sites. Instead of directly breaching individual websites, attackers compromised upstream files hosted on Awesome Motive’s infrastructure. When loaded, the malware executed stealthily, activating only during authenticated WordPress admin sessions to evade detection. The payload gathered site metadata and authentication tokens, then attempted to create unauthorized admin accounts including a fixed account named developer_api1 and randomized accounts following the dev_xxxxxx pattern. The malware established persistence by installing a hidden backdoor plugin, disguised as tools like "Content Delivery Helper" or "Database Optimizer", which evaded WordPress dashboards, API responses, and logs. It enabled full remote control, allowing arbitrary command execution via crafted requests. Stolen data was encrypted and sent to a command-and-control server at tidio[.]cc (84.201.6.54), a domain mimicking a legitimate service. Awesome Motive attributed the breach to a vulnerability in the UpdraftPlus plugin, which attackers exploited to access a marketing server, retrieve a CDN API key, and inject malicious code. The company has since removed the scripts, rotated credentials, purged CDN caches, and migrated affected systems. Patchstack reported blocking hundreds of exploitation attempts, confirming active abuse of the backdoor. Administrators are advised to audit for rogue admin accounts, scan for hidden plugins, and rotate credentials if an admin session occurred during the attack window. The incident underscores the escalating risk of supply chain attacks in the WordPress ecosystem, where a single compromised vendor can impact millions of sites.