Thirty plugins. Hundreds of thousands of installations. One buyer, whose first code commit was a backdoor.

An unidentified buyer operating under the name “Kris” purchased the entire Essential Plugin portfolio — formerly WP Online Support, an eight-year-old business with 30+ WordPress plugins — through the marketplace Flippa for a six-figure sum. Flippa even published a case study celebrating the sale.

The buyer’s first move was to inject malicious code into every plugin. On August 8, 2025, a commit labeled “Check compatibility with WordPress version 6.8.2” actually added 191 lines of backdoor code hidden inside the plugins’ existing analytics module, according to security analysis by Anchor Hosting and mySites.guru.

The code phoned home to an attacker-controlled server. For eight months, it returned normal responses. Then on April 5–6, 2026, it activated — downloading a backdoor disguised as a WordPress core file and injecting SEO spam into wp-config.php. The spam displayed only for Googlebot, invisible to site owners. The command-and-control domain resolved through an Ethereum smart contract, rendering traditional takedowns useless.

WordPress.org responded on April 7, permanently closing all 30+ plugins, and force-pushed updates on April 8 that disabled the phone-home function. But the update does not remove code already injected into wp-config.php. Sites that ran these plugins before April 8 may still be compromised.

The core failure is procedural. WordPress.org verifies that a seller authorizes a plugin transfer but does not vet the buyer, review the new owner’s first commit, or notify users of the change. According to mySites.guru, the transfer process “worked exactly as designed. It just was not designed for this.”

WordPress runs roughly 40% of the web. Its plugin ecosystem operates on inherited trust, with no mechanism to re-verify it when ownership changes hands.

Sources