WordPress Plugin Security Alert: What Website Owners Need to Know and Do Right Now

If you use WordPress and install plugins from the official WordPress.org directory, this is something you need to read carefully.

The WordPress.org Plugins Team has confirmed that several plugins from the author “essentialplugin” were found to contain malicious code that allowed unauthorized third-party access to any website using them. The plugins have been removed from the directory, but the damage they may have already caused on affected sites is a different matter entirely.

What These Plugins Actually Did

This was not a simple coding mistake or a minor policy violation. The plugins were deliberately designed to download code from an external server, specifically analytics.essentialplugin.com, and install it silently on your website without your knowledge or consent.

What that code installed was a backdoor, a hidden entry point named “wp-comments-posts.php”, crafted to look almost identical to a legitimate WordPress core file called “wp-comments-post.php”. The single extra letter in the filename is intentional. It is designed to evade detection by administrators who might scan their file list.

Once that backdoor was in place, it was used to inject hidden spam links into websites, create unauthorized redirects sending visitors to third-party destinations, inject entire hidden pages into sites, and modify the wp-config.php file, which is one of the most sensitive files in any WordPress installation. All of these are classic black-hat SEO techniques, invisible to the site owner but highly visible to search engines and the people behind the attack.

What WordPress.org Has Done

The plugins have been closed and removed from the directory. WordPress.org also pushed an automatic update that attempted to remove the backdoor code from affected sites. However, and this is the critical point, they cannot confirm the automatic removal was complete. The backdoor may have been copied to locations the update tool was not aware of, and unauthorized actions may have already been taken on your site before any of this was caught.

What You Need to Do

Do not assume the automatic update fixed everything. Treat your site as potentially compromised and take the following steps immediately.

Check your files for the rogue backdoor file “wp-comments-posts.php”. It does not belong there. If you find it, delete it. Then look for any other recently modified or unfamiliar files, particularly in your root directory, your wp-content folder, and your wp-config.php file.

Review your wp-config.php for any code you did not put there. Unknown lines, obfuscated strings, or anything that references external URLs should be treated as suspicious.

Check your site for hidden pages, unexpected redirects, or outbound links you did not create. Tools like Google Search Console can reveal indexed pages and links that are invisible to you as an administrator but visible to search engines.

Change all passwords immediately, including your WordPress admin password, your hosting control panel password, your FTP/SFTP credentials, and your database password. If the backdoor had access to wp-config.php, assume your database credentials were exposed.

Contact your hosting provider and inform them of the situation. They may have server-level logs that reveal what actions were taken and when, and they can assist with a deeper file system scan.

If you are not confident in your ability to perform a thorough security audit yourself, engage a professional WordPress security service. The cost of a proper cleanup is far lower than the cost of a site that has been blacklisted by Google or used to send spam to your customers.

The Broader Lesson

This incident is a reminder that the WordPress plugin ecosystem, despite its size and general reliability, is not immune to malicious actors. Even plugins hosted on the official directory can carry serious risks if they have not been properly vetted or if a trusted author account is compromised.

Keep the number of plugins on your site to what you genuinely need. Review installed plugins periodically and remove anything you are no longer using. Consider a reputable security plugin that monitors file changes and alerts you to suspicious activity. And always keep WordPress core, themes, and plugins updated, not because updates are always safe, but because running outdated software is an even larger risk.

If your site was affected by this incident, act now. The longer a backdoor remains on a compromised site, the more damage accumulates, and the harder it becomes to fully recover.