In early April 2026, thousands of WordPress website owners found out that their sites had been compromised without their knowledge. Not by a hacker getting past a firewall, but by a normal plugin update that they probably clicked “approve” on without thinking about it.
The attack was aimed at a group of more than 30 plugins that were sold under the name Essential Plugin. In early 2025, Flippa, a public marketplace for digital businesses, sold an eight-year-old real business for six figures. The buyer, identified only as “Kris,” had a background in SEO, cryptocurrency, and online gambling marketing.
The buyer’s very first code commit after acquiring the business planted the backdoor. On August 8, 2025, version 2.6.7 of the plugins came out. It added 191 lines of code, but the changelog only said, “Check compatibility with WordPress version 6.8.2.” Inside was a PHP deserialisation backdoor, which is a way for an attacker to run code on another person’s server and take full control of function names, arguments, and execution.
After that, nothing happened. For eight months, the malicious code sat completely dormant. It only showed spam to Googlebot, so site owners couldn’t see it when they visited their own sites. To make matters harder to contain, the attacker resolved its command-and-control domain through an Ethereum smart contract, meaning traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time.
The WordPress.org plugins team acted quickly when they found out about the problem and permanently shut down 31 affected plugins on April 7th. By that time, the damage had affected more than 400,000 active installations.
This Is Not a Reason to Fear WordPress
As a team that has built and maintained hundreds of WordPress sites, we want to make it clear that attacks like this will happen. There will always be bad actors, and open-source ecosystems make it easier for determined attackers to find weaknesses.
This attack didn’t show a serious flaw in WordPress, it showed a gap in the structure. While the WordPress.org plugin directory reviews new submissions, it has no mechanism to review code or notify users when an existing plugin changes ownership. The trust that a plugin developer builds up over eight years of honest work is instantly and quietly passed on to the new owner.
That’s a problem with governance, and the WordPress community is now talking about it. But that doesn’t mean you should stop using the platform that powers more than 40% of the world’s websites.
What it is a reason to do is ask harder questions about who is managing your website and whether they have the processes in place to catch exactly this kind of thing before it becomes your problem.
The Real Risk Is Complacency, Not WordPress
When we take over websites from other agencies, we see a consistent pattern. Sites built and managed the same way they were being built ten years ago. Plugins that were installed and then forgotten. There is no thought or due diligence put into how plugins are used; the only thing that matters is what seems to be the easiest plugin to use at the time of development to speed up production.
This isn’t a problem with technology. There is a problem with discipline.
It’s not hard to see how it happens. Web agencies have to meet strict deadlines all the time to meet client expectations. When a site is live and not visibly broken, reviewing the plugin stack doesn’t feel urgent. But that’s the very window that attackers are hoping for. The eight months of dormancy in this attack were planned because the attackers thought no one would be paying close attention.
The site owners and agencies that were hit by this attack weren’t careless. They were busy people who trusted software that had been around for a long time and had no idea that that trust had been given to someone else with very different plans.
What Good Plugin Management Actually Looks Like
We only use approved plugins at Clickk. A plugin doesn’t make it onto a client site because it does what we need. It makes it onto the approved list because it meets a defined set of criteria, and that list is reviewed on a fortnightly basis in a dedicated stack meeting.
Here’s what that vetting process looks like in practice:
Ratings and install volume matter, but they’re a starting point. We look for plugins that have at least 4.5 stars and a lot of downloads. But a high number of installs isn’t a good sign on its own. There were hundreds of thousands of installations of the Essential Plugin portfolio. We go even further for plugins that have less than 100,000 downloads: forums, user reports, and community discussions. Real users reporting strange behaviour or code changes are often the first sign that something is wrong.
We look into the parent company, not just the plugin. Some developers own and take care of more than one plugin, and that makes a big difference. For example, Crocoblock, a very well-known company with a long history of making great products makes a less well-known plugin called JetTabs. A star rating alone doesn’t tell you much. Knowing who made a plugin, how long they’ve been in business, and what else they do gives you a lot more information.
When we can’t trust a plugin, we build our own. Sometimes a plugin does exactly what a client needs, but we won’t use it. The history of ownership might not be clear, the number of downloads might be too low for the community to really look into it, or the codebase might not be kept up to date consistently. We make a custom plugin in those situations. It takes more work up front, but it takes away an unknown factor from the security equation completely.
Our fortnightly stack meetings exist for exactly this reason. The WordPress ecosystem is always changing. You need to plan ahead for big changes like the release of Elementor 4 or the move to WordPress 7 that is coming up. Every two weeks, we hold a stack meeting. While this ensures continuous discipline, the specific tasks of reviewing our active plugin stack, checking for ownership changes, assessing updates, and planning ahead are items up for discussion.
5 Questions to Ask Any Web Agency Before You Trust Them With Your Site
1. Do you have an approved plugin list?
A trustworthy agency should be able to tell you that they don’t just install any plugin that works. There should be a list of approved tools, a vetting process, and written criteria. If they say “we use whatever is most popular” or “we find the best-reviewed one at the time,” that’s a bad sign.
2. How do you check a plugin before you use it?
Pay attention to the little things, like ratings, how many times the app is installed, and how often it gets updates. The more sophisticated answer is to look into the parent company, read community forums, and find out who really owns the software. If they mention checking ownership history, that’s a very good sign.
3. What happens when a plugin you’re using gets a major update?
Updates for plugins aren’t always safe. A legitimate update can introduce instability; a malicious one can introduce a backdoor. Agencies should have a process for reviewing significant updates before pushing them to client sites.
4. Do you have regular meetings to review your technology stack?
This one is a sign. Agencies that review their stacks every two weeks or every month see technology management as an ongoing job, not something they can set and forget. The backdoor for the Essential Plugin was inactive for eight months. Regular, organised reviews are what stop problems from getting worse before they happen.
5. Have you ever decided not to use a plugin and instead made something from scratch?
This question shows how an agency balances safety with ease of use. The answer you’re looking for isn’t “yes, all the time” because custom development isn’t always the right call. If the answer is “no, we always find a plugin,” that means that convenience is always winning out over scrutiny. An agency that has made custom solutions for security reasons knows exactly what the limits are.
The Bigger Picture
You should pay attention to the Essential Plugin attack, but not because it should make you afraid of WordPress. It should make you think about who is in charge of your site and how they do their job.
WordPress is a mature platform that has a lot of support, and its security has really gotten better over the past ten years. Hosting companies are sending out automatic PHP updates. The core of WordPress is kept up to date more often. Site owners are becoming more aware of how important it is to keep everything up to date.
But the human part has always been, and still is, the weakest link. The discipline to keep checking what works, what has changed, and what new information has come to light about the tools you trust. To do this job well, you need to keep learning it over and over. The WordPress ecosystem in 2026 is not the same as it was in 2015, and agencies that act like it is are putting their clients at risk.
The buyer of the Essential Plugin thought no one would notice for eight months. The purpose of the biweekly stack meeting at Clickk is to be the person who notices.
We’re happy to talk about how you’re managing your current WordPress setup or what it should look like.
Clickk is a WordPress design, development, and hosting agency. We build and maintain WordPress websites with a security-first approach, including vetted plugin standards, regular stack reviews, and managed hosting.
