All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

The injected backdoor grants an attacker persistent, unauthorized access to affected WordPress websites. This allows for a wide range of malicious activities, including data exfiltration, website defacement, and the injection of spam content. The attacker can effectively control the compromised website, potentially using it to distribute malware or launch further attacks against visitors. The blast radius extends to all users of the affected plugins, and the impact can be significant, leading to reputational damage and financial losses. This backdoor is particularly concerning due to its persistence, allowing attackers to maintain access even after initial exploitation.

1. Gereserveerd2026-04-16
2. Gepubliceerd2026-04-17
3. Gewijzigd2026-04-22
4. EPSS bijgewerkt2026-04-24

The primary mitigation for CVE-2026-6443 is to immediately upgrade Essentialplugin WordPress plugins to version 3.7.1.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block suspicious activity related to backdoor access attempts can provide an additional layer of protection. Regularly review WordPress plugin activity logs for any unusual behavior that might indicate compromise.

Actieve installaties

20KNiche

Plugin-beoordeling