Supply Chain Attack Hits Three WordPress Plugins: PushEngage, OptinMonster, TrustPulse Backdoored

An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way to break into the sites. When a site administrator was logged in as the file loaded, the code created an admin account under the attacker’s control and installed a hidden plugin that opened a way back in. Ordinary visitors did not trigger it. Any site that was hit should be treated as compromised.

All three plugins are run by one company, Awesome Motive, which had not commented on the two larger plugins as of June 15. Security firm Sansec disclosed the wider campaign on June 13, finding the same malicious code in JavaScript served for all three plugins. PushEngage followed a day later with its own incident notice, confirming an attacker had served tampered copies of its script and that sites loading them could be taken over.

The poisoned script did nothing on a normal page view. It acted only when a logged-in WordPress administrator loaded it, then used that admin’s session to take over. In PushEngage’s case, the tampered files were its normal embeds, pushengage-web-sdk.js and pushengage-subscription.js, served from clientcdn.pushengage.com. OptinMonster and TrustPulse were hit through separate Awesome Motive CDN endpoints.

Once the script ran with an administrator logged in, it: used that admin’s session to act with full permissions, created a new admin account under the attacker’s control, installed a plugin that does not show up in the dashboard, and sent the new login details and site information to tidio[.]cc, a fake domain made to look like the real tidio.com. The hidden plugin is a web shell, a remote command channel: anyone who knows the right URL can run code on the server without logging in.

PushEngage says the attacker first broke into the server running its marketing website, through a known flaw in UpdraftPlus, a WordPress backup plugin. That server is separate from the systems that run the product and store customer data. With a CDN API key, the attacker changed the files the CDN was already delivering to customer sites. Sansec is not convinced the entry point is settled. UpdraftPlus does have a separate authentication-bypass bug, CVE-2026-10795, that Wordfence rates 8.1 (high severity); it is now patched.

Indicators of Compromise (IoCs) from Sansec: Under wp-content/plugins, look for folders named content-delivery-helper or database-optimizer. Delete any admin accounts you did not create, especially developer_api1 or anything matching dev_xxxxxx. Review web server access logs from June 12 to 14 UTC for outbound traffic to tidio.cc, including its /cdn-cgi/ paths, and to the attacker’s server at 84.201.6.54.