If you have a WordPress website, you may have seen some noise recently about a security incident involving a popular set of plugins. Without getting into the technical details, here is the short version: a company that made over 20 widely used WordPress plugins was sold to a new owner, who quietly planted malicious code across all of them. That code sat dormant for months before being activated in April 2026, at which point it could give an attacker access to any WordPress site running one of those plugins.
It is the kind of story that makes WordPress sound scary. We want to explain why it is not, and why the way you manage a WordPress site matters far more than the platform itself.
What Actually Happened
A developer who had been building WordPress plugins since 2015 sold their entire portfolio of plugins through an online marketplace. The buyer, rather than continuing to maintain them legitimately, used the acquisition to plant hidden code across all 20+ plugins at once.
Because the plugins were already trusted and installed on thousands of websites, the malicious code came along for the ride, disguised as a routine compatibility update. Most website owners had no idea anything had changed.
This type of attack is known as a supply chain compromise. Rather than attacking your website directly, the attacker targets something your website already trusts, in this case a plugin from a developer with a decade-long track record.
The WordPress security team identified and responded to the issue, pushing forced updates and removing the affected plugins from the official directory. But the incident highlights a real and ongoing risk that has nothing to do with WordPress being inherently insecure.
The Real Issue Is Not WordPress
WordPress powers around 40% of all websites on the internet. That scale means it attracts attention from bad actors, but it also means it has one of the most active security communities of any platform in the world. Vulnerabilities get found and patched quickly. The core platform is well maintained.
The risk does not come from WordPress itself. It comes from the plugin ecosystem, and more specifically, from how plugins are chosen, monitored, and managed.
There are over 60,000 plugins available in the WordPress directory. Some are maintained by large, well-resourced development teams. Others are built and abandoned by solo developers who move on, sell up, or simply stop paying attention. A plugin that was perfectly safe two years ago may not be today.
For website owners without a technical background, there is no obvious way to tell the difference.
How Clickk Approaches This
At Clickk, we maintain what we call an approved stack, a defined set of plugins that we have vetted, trust, and use across the websites we build and manage.
Every plugin in our stack has been assessed for code quality, the reputation and track record of the developer behind it, how actively it is maintained and updated, its history of security vulnerabilities, and how widely it is used and scrutinised by the broader security community.
When we build a website, we do not browse the plugin directory and install whatever looks useful. We work from our approved stack, and we only add something new after it has been properly evaluated.
This approach does two things. It limits the surface area for attacks, as fewer plugins means fewer potential entry points. And it means we are actively monitoring the tools we use, so when something like the EssentialPlugin incident happens, we can check our exposure immediately and act quickly if needed.
In this particular case, none of the affected plugins were part of our stack. Our clients were not at risk.
What This Means If You Have a WordPress Site
If your website was built and is managed by Clickk, you do not need to do anything. We monitor this kind of thing as part of how we work.
If you have a WordPress site that is not managed by us, or if you are unsure what plugins are running on your site, it is worth asking whoever manages your website whether they have checked your exposure to this incident. And more broadly, whether they have a clear process for vetting and monitoring the tools they install on your site.
A website is not something you build once and forget. Plugins get updated, developers sell their businesses, and the threat landscape changes. Ongoing management and oversight is what keeps a WordPress site secure over time, not the initial build.
A Note on WordPress Security
We build on WordPress because it is genuinely excellent for most businesses, flexible, well-supported, cost-effective, and capable of handling everything from simple brochure sites to complex e-commerce platforms.
Security incidents like this one are worth knowing about, but they should not shake your confidence in the platform. They should make you ask good questions about how your website is being managed and whether the people looking after it are paying attention.
If you have questions about your website’s security or want to understand how we approach plugin management at Clickk, feel free to get in touch.
