How did the attackers gain access to the CDN?

The attackers exploited a vulnerability in the UpdraftPlus plugin on the OptinMonster marketing website to gain server access. From there, they obtained CDN API keys allowing them to modify the JavaScript SDK files served to customers.

Does updating the affected plugins remove the malicious code?

No. The malicious code was injected at the CDN level, not in the plugin files. Even fully updated plugins could load the tampered scripts until the CDN caches were cleared and the vendor removed the malicious files.

How can I detect if my site was compromised?

Check for unknown administrator accounts, especially with names like developer_api1 or randomized dev_xxxxxx. Scan for unexpected plugins or files, and review recent user creation logs. Use security tools capable of detecting backdoors and unauthorized changes.

What makes this attack different from typical WordPress plugin vulnerabilities?

This attack runs client-side within the administrator’s browser session, leveraging valid credentials and nonces to perform authenticated actions. It does not exploit server-side plugin code vulnerabilities directly, making detection and prevention more complex.

How can I protect my WordPress sites against similar supply chain attacks?

Minimize reliance on third-party CDN-hosted scripts where possible, enforce strong admin security with 2FA, restrict admin access, monitor user activity closely, and keep all software up to date. Use security solutions that inspect client-side behavior and apply mitigation rules for known attack vectors.

Supply Chain Attack on OptinMonster, TrustPulse & PushEngage: Rogue Admins Created

Security

Supply Chain Attack on OptinMonster, TrustPulse, and PushEngage: Tampered CDN Scripts Auto-Creating Rogue Admins

A supply chain attack compromised the CDN-hosted JavaScript SDKs of OptinMonster, TrustPulse, and PushEngage, widely used WordPress marketing plugins. The injected client-side code silently created rogue admin accounts and backdoors by exploiting logged-in administrators' sessions. This incident highlights the risks of third-party CDN dependencies and requires immediate action from WordPress users to audit users, remove backdoors, and harden admin security.

Jul 8, 2026 · 6 min read