A long security write-up claims that a WordPress plugin portfolio was quietly turned into a supply-chain attack after it changed hands. According to the post, a buyer identified only as Kris acquired the Essential Plugin business through Flippa, then used the first SVN commit after the sale to plant a backdoor in a plugin module that had already been trusted by thousands of sites.
The researcher says the affected plugin, Countdown Timer Ultimate, contained a wpos-analytics module that phoned home to analytics.essentialplugin.com, downloaded a backdoor file named wp-comments-posts.php and used it to inject malicious PHP into wp-config.php. The post says the injected code was not a simple spam payload. It fetched spam links, redirects and fake pages from a command-and-control server and displayed them only to Googlebot so site owners would not see the abuse directly.
The most unusual claim is how the command-and-control domain was resolved. The researcher says the malware used an Ethereum smart contract to look up the active C2 address, which would make conventional takedowns less effective because the attacker could change the domain without changing the code on infected sites. That detail turns the case from a standard plugin compromise into a more durable infrastructure problem.
The post says the malicious module sat dormant for eight months after version 2.6.7 was released on August 8, 2025, before being activated on April 5 and 6, 2026. It also says the site owner found the change by comparing backups across multiple dates and tracing plugin snapshots. Those are forensic claims from the researcher, not findings from WordPress.org, but they are specific enough to show how the compromise was allegedly introduced and when it appeared to go live.
The scope is broader than one plugin. The write-up says at least 30 plugins from the same author family were permanently closed by the WordPress.org Plugins Team on April 7, 2026. It further says the analytics.essentialplugin.com endpoint now returns a closed message and that the author search on WordPress.org no longer shows results for the group. If accurate, that means the platform responded by cutting off the entire plugin line rather than trying to surgically repair one affected package.
The article is also about process, not just malware. The researcher argues that WordPress.org has no meaningful mechanism for flagging ownership transfers, reviewing a change of control or warning users when a popular plugin moves from one owner to another. That absence, the post says, lets a trusted brand be acquired and then turned into a distribution channel for malicious code. The comparison to an earlier Display Widgets compromise makes the point sharper: the same playbook can be repeated at a much larger scale when ownership changes are not treated as a security event.
The supplied evidence comes from a single security investigation, so the cleanest way to report it is as such: one researcher says a broad plugin portfolio was weaponized after acquisition, and WordPress.org later force-closed the affected author line. The technical details in the post are detailed enough to be newsworthy on their own.
