OptinMonster CDN breach exposes WordPress sites to backdoors

A security breach in Awesome Motive’s content delivery network (CDN) has exposed WordPress sites using OptinMonster, TrustPulse, and PushEngage plugins to a supply-chain attack. The incident, discovered by e-commerce security firm Sansec, involved malicious JavaScript served to users of these plugins, enabling attackers to gain full control over compromised websites. The attack highlights risks associated with third-party CDN dependencies and the challenges of securing plugin ecosystems at scale.

What happened

On June 12, attackers exploited a known vulnerability in the UpdraftPlus WordPress plugin to gain access to a non-production server within Awesome Motive’s environment. While the server hosted only a marketing website and was isolated from production systems, it contained credentials for the company’s CDN account. The intruders stole these credentials and used them to modify JavaScript files distributed via the CDN, injecting malicious code into three plugins: OptinMonster, TrustPulse, and PushEngage.

The malicious scripts activated when WordPress administrators visited pages on infected sites, harvesting authentication tokens and nonces. These were used to create rogue administrator accounts, such as developer_api1 or dev_xxxxxx, and install a self-hiding backdoor plugin. The backdoor, disguised as legitimate tools like Content Delivery Helper or Database Optimizer, provided attackers with remote access capabilities, including a web shell and arbitrary PHP code execution. Sansec noted that the plugin’s logic remained identical across renames, suggesting a deliberate effort to evade detection.

OptinMonster, the most widely affected plugin with over 1.2 million active installations, served malicious code between 22:17 UTC and 22:42 UTC on June 12. TrustPulse was similarly compromised during this window, while PushEngage continued delivering infected JavaScript until 19:02 UTC the following day. Awesome Motive confirmed the breach in a security advisory, stating that the attack did not compromise its application servers, source code, or customer data storage systems.

Impact and remediation

The attack’s design—targeting administrators specifically—allowed attackers to bypass traditional security measures and establish persistent access to compromised sites. The rogue admin accounts and backdoor plugins remain active even after the malicious CDN content was removed, requiring manual intervention from site owners. Awesome Motive has since rotated all credentials, migrated the affected marketing site to a new server, and revoked the compromised CDN API key.

Site owners are advised to take immediate steps to mitigate the breach’s effects. These include scanning for and removing rogue admin accounts, inspecting the wp-content/plugins directory for hidden backdoor plugins, and running server-side malware scans. Additionally, rotating administrator passwords, API keys, database credentials, and WordPress security salts is critical to prevent further unauthorized access. Failure to remove the backdoor plugins leaves sites vulnerable to ongoing exploitation, even after the CDN-level threat has been neutralized.

Broader implications

The breach reflects growing risks in the WordPress plugin ecosystem, where supply-chain attacks can rapidly scale due to widespread adoption of popular tools. OptinMonster’s large user base—over a million sites—amplified the attack’s reach, demonstrating how a single vulnerability can cascade across thousands of unrelated websites. The use of a CDN to distribute malicious code further complicates detection, as the attack leverages trusted infrastructure to evade scrutiny.

Sansec’s findings also highlight the sophistication of modern supply-chain attacks. By impersonating legitimate services (e.g., a domain mimicking Tidio) and rotating backdoor disguises, attackers can maintain access long after the initial breach. This incident serves as a reminder for security teams to monitor not only direct threats but also indirect vectors, such as third-party dependencies and CDN-delivered content.