Critical OptinMonster Vulnerability Exposes 1.2M WordPress Sites

Key Takeaways

• A significant supply chain attack compromised JavaScript files served by Awesome Motive’s CDN, affecting over 1.2 million WordPress sites using plugins like OptinMonster, TrustPulse, and PushEngage.
• Attackers injected malicious code that creates hidden administrator accounts and installs stealthy backdoors, allowing full remote control.
• The malware activates only when a WordPress administrator is logged in, making it difficult to detect through automated scans.
• The incident stemmed from a vulnerability in the UpdraftPlus plugin, which granted attackers access to a server and a CDN API key.
• Awesome Motive has addressed the immediate threat by removing malicious scripts, rotating credentials, and migrating infrastructure, but site administrators must take immediate action to verify and secure their installations.

A widespread supply chain attack has potentially exposed more than 1.2 million WordPress websites, according to security researchers. The attack involved injecting malicious code into legitimate JavaScript files associated with popular WordPress plugins, subsequently distributed through a trusted content delivery network (CDN) infrastructure.

Researchers at Sansec identified an ongoing campaign targeting plugins developed by Awesome Motive, a prominent vendor in the WordPress ecosystem. Affected plugins include OptinMonster, TrustPulse, and PushEngage, which collectively boast millions of installations globally. OptinMonster alone accounts for over one million active sites.

Instead of directly assaulting individual WordPress installations, threat actors opted for an upstream compromise, tampering with JavaScript files hosted on Awesome Motive’s CDN. This strategy meant that any website loading these compromised scripts unknowingly executed the injected malware, mirroring the significant impact of previous large-scale supply chain breaches.

The malicious payload is engineered for stealth, designed to activate only when a WordPress administrator is actively logged into the backend. It also incorporates evasion techniques, such as avoiding execution in headless browsers and automated environments, which significantly reduces the likelihood of detection during routine security scans.

Mechanism of Compromise and Persistence

Upon activation, the script systematically identifies the WordPress admin environment, collects essential site metadata, and extracts authentication tokens from REST and AJAX endpoints. Leveraging these stolen tokens, the malware attempts to establish unauthorized administrator accounts through various methods, including direct REST API calls and form submissions.

The injected scripts were served via several legitimate domains associated with Awesome Motive’s services, including:

• a.omappapi.com
• a.opmnstr.com
• a.optnmstr.com
• a.trstplse.com
• clientcdn.pushengage.com

To ensure long-term access, the attackers establish persistence by creating a fixed administrator account named “developer_api1” and additional randomized accounts following the “dev_xxxxxx” pattern. Stolen credentials and site details are encrypted and then transmitted to a command-and-control server operating under the domain tidio.cc, a domain chosen to mimic a legitimate service and evade suspicion.

Furthermore, the attackers install a hidden backdoor plugin designed to remain undetectable. This plugin conceals itself from the WordPress dashboard, API responses, update mechanisms, and activity logs, providing attackers with full remote control over compromised websites. This control extends to arbitrary command execution and remote code execution via specially crafted requests.

Indicators of Compromise (IoCs)

Organizations should meticulously check for the following indicators:

• Suspicious domains: tidio.cc (IP address: 84.201.6.54)
• Rogue admin accounts: “developer_api1” or accounts matching the “dev_xxxxxx” pattern.
• Hidden plugins: Look for plugins disguised as “content-delivery-helper” or “database-optimizer.”
• Unique string: The XOR key “jX9kM2nP4qR6sT8v” may appear in malicious code.

Sansec researchers noted that the backdoor plugin frequently changes its disguise to evade detection. Active exploitation has been confirmed, with Patchstack reporting hundreds of attempts to create rogue administrator accounts across numerous sites, demonstrating real-world abuse of the backdoor.

Vendor Response and Root Cause

Awesome Motive stated that the incident originated from the exploitation of a vulnerability within the UpdraftPlus plugin. Attackers reportedly gained unauthorized access to a server hosting marketing infrastructure, from which they retrieved a CDN API key. This key was then used to inject malicious code into files distributed to customers via the CDN.

In response, Awesome Motive has taken decisive action, including the removal of all malicious scripts, rotation of compromised credentials, purging of CDN caches, and migration of affected systems to new, secure infrastructure.

What You Should Do

Administrators utilizing the affected plugins are strongly advised to assume potential compromise if a logged-in admin session occurred during the attack window. Immediate mitigation steps include:

• Audit Administrator Accounts: Thoroughly review all administrator accounts for any unauthorized entries, particularly “developer_api1” or accounts following the “dev_xxxxxx” pattern. Delete any suspicious accounts immediately.
• Scan Filesystem for Hidden Plugins: Manually inspect your WordPress installation’s filesystem for hidden plugins like “content-delivery-helper” or “database-optimizer” that are not visible in the dashboard. Remove them if found.
• Rotate All Credentials: Change all WordPress user passwords, database credentials, and any API keys associated with your WordPress site.
• Implement Server-Side Inspection: Since the malware activates during authenticated admin sessions, implement enhanced server-side logging and inspection to detect anomalous behavior.
• Monitor Network Traffic: Watch for outbound connections to suspicious domains, especially tidio.cc.
• Stay Updated: Ensure all WordPress core files, themes, and plugins are kept up-to-date with the latest security patches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.