Supply Chain Attack on OptinMonster & Co.: 1.2M WordPress Sites Hit

Published on 2 August 2026

Your website may have quietly acquired a hidden administrator account and a backdoor – completely unnoticed, even though you did everything right and kept your plugins up to date. That is precisely the insidious logic of the supply-chain attack that threatened around 1.2 million WordPress websites between 12 and 15 June 2026. Three very popular marketing plugins were affected at once: OptinMonster, TrustPulse and PushEngage. All three come from the US vendor Awesome Motive. And all three briefly delivered manipulated malicious code – not because of a security hole in the plugin itself, but through the vendor's delivery infrastructure.

In this article we explain in plain terms what happened, who might be affected, how you can specifically check this, and what you need to do now – including the important GDPR obligations for German website operators.

What happened?

The attackers did not target your website directly, but the supply chain – hence the term "supply-chain attack" (an attack in which a trusted source further up the chain is manipulated so that the malicious code is automatically distributed to all downstream users).

The process took place in two stages:

1. Entry via another security hole: The perpetrators exploited the critical vulnerability CVE-2026-10795 (CVSS score 9.8 out of 10 – "critical") in the widely used backup plugin UpdraftPlus to gain access to the server of the Awesome Motive marketing website. On this server sat an API key (a digital master key for a specific system) for the "BunnyNet" content delivery network.
2. Manipulation of the CDN scripts: A CDN (Content Delivery Network) is a network of servers that delivers files quickly worldwide. With the stolen key, the attackers directly manipulated the JavaScript files of the three plugins, which are loaded from this CDN onto millions of customer sites.

The affected files included: a.omappapi.com/app/js/api.min.js, a.trstplse.com/app/js/api.min.js and clientcdn.pushengage.com/sdks/pushengage-web-sdk.js. The malicious code was appended to the end of the legitimate file – so the plugins continued to function completely normally while the attack ran in the background.

"This resembles the Polyfill supply-chain attack that Sansec discovered in 2024: you manipulate a single upstream file, and the malware reaches thousands of downstream websites without ever touching them individually." – Sansec Forensics Team

The technical core: why administrators specifically were the victims

The injected code was extremely cleverly disguised. It remained completely inactive for normal website visitors. Only when a logged-in WordPress administrator loaded the page – recognisable by wp-admin paths, the admin bar or the login cookie – did the attack chain start:

• Theft of security tokens: The code collected so-called nonces (one-time security codes with which WordPress secures authorised actions).
• Creation of a shadow admin: Using four different fallback methods, the script created a new administrator account – either with the fixed name developer_api1 (email: customer1usx@gmail.com) or with random names in the pattern dev_xxxxxx (e.g. dev_3m6nyp).
• Installation of a backdoor: A backdoor plugin (hidden back door) was installed – disguised as "Content Delivery Helper" (v2.7.1) or "Database Optimizer" (v2.9.4). This plugin actively hides itself from the plugin list, the user list and the update checks in the dashboard.
• Data exfiltration: The captured credentials were encrypted (XOR with key jX9kM2nP4qR6sT8v) and sent to the control-server domain tidio.cc (IP 84.201.6.54) – a lookalike domain modelled on the legitimate tidio.com and already registered on 28 April 2026. A clear indication of a long-planned operation.

The backdoor opened two unauthenticated access points: a web shell (a remote-control tool for the server) via the parameter ?developer_api1_fm and a code-execution point via developer_api1_eval. This effectively gave the attacker full control over the affected website.

Dave Jong, Security Research Lead at Patchstack, sums up the insidiousness:

"This is not CSRF and not a plugin bug. The malicious requests carry the administrator's legitimate session and a legitimate nonce, because the administrator's own browser makes them. The administrator is the victim, not the attacker. A web application firewall cannot stop a browser from loading a compromised CDN script."

Who is affected?

Potentially affected are all websites that used one of the three plugins – OptinMonster, TrustPulse or PushEngage – and loaded the manipulated CDN scripts during the exposure window. OptinMonster alone has over 1 million active installations.

Important for context: Only potentially exposed were around 1.2 million sites. Actually compromised were only those where an administrator was logged in during the time window. The exposure window varied in length:

• OptinMonster / TrustPulse: approx. 25 minutes (12 June 2026, 22:17–22:42 UTC)
• PushEngage: several hours, until the cleanup on 14 June 2026, 08:44 UTC

Between 14 and 15 June, Patchstack blocked 271 real exploit attempts against 13 websites from 81 different IP addresses. Around 60 percent of the traffic came from mobile devices – proof that it was indeed the browsers of real administrators triggering the attacks, not a central attacker server.

How to check whether you are affected

Since the backdoor actively hides itself in the dashboard, a glance at the WordPress backend is not enough. Trust the file system, not what is displayed in the admin area.

1. Check administrator accounts: Under Users > All Users, search for the name developer_api1 (email: customer1usx@gmail.com) and for the pattern dev_xxxxxx. Delete such accounts immediately.
2. Check the file system (via FTP/SSH/file manager): In the directory wp-content/plugins/, look for the folders content-delivery-helper and database-optimizer.
3. Search the code: Using grep or a file manager, search all PHP files under wp-content/ for the strings developer_api1_fm, developer_api1_eval and the XOR key jX9kM2nP4qR6sT8v.
4. Check the web server logs: Review the access log (access.log) for connections to tidio.cc and the IP 84.201.6.54 in the period 12–15 June 2026 (UTC). Also watch for POST requests to /wp-json/wp/v2/users, /wp-admin/user-new.php and /wp-admin/admin-ajax.php with unknown usernames.
5. Run a server-side malware scan: Since the payload only triggers for logged-in admins, client-side checks are unreliable. Use a server-side scanner such as Sansec eComscan, Wordfence (with server scan) or Imunify360.
6. Match the time window: Was one of the three plugins active between 12 and 14 June 2026 and was an administrator logged in during that period? If both apply, treat a compromise as likely.

What you must do now

1. Update UpdraftPlus: Immediately bring the backup plugin to version 1.26.5 (free) or 2.26.5 (Premium) to close the entry-point hole CVE-2026-10795. The patch has been available since 5 June 2026.
2. Delete rogue accounts: Remove all identified accounts (developer_api1, dev_xxxxxx).
3. Remove the backdoor plugin: Delete the folders content-delivery-helper and database-optimizer directly in the file system – not via the dashboard, since they hide themselves there.
4. Full password and key rotation if compromised: Change all administrator passwords, renew the WordPress Security Keys/Salts in the wp-config.php (via the official generator api.wordpress.org/secret-key/1.1/salt/), change the database password, and rotate all API keys and application passwords.
5. Block the C2 domain: Block tidio.cc and the IP 84.201.6.54 at the DNS or network level.
6. When in doubt: restore a clean backup. Since the backdoor allows unauthenticated code execution, further persistence mechanisms may exist. Restore the installation from a verifiably clean backup and check the database for injected content.
7. Secure preventively: Enable two-factor authentication (2FA) for all admin accounts, minimise the number of admin accounts, regularly review plugins and users, and – where possible – deploy Subresource Integrity (SRI) and a Content Security Policy (CSP) for external scripts.

An important note: A plugin update of the three marketing plugins is not required as protection – and would not have been a solution either. Since the manipulation took place at the CDN level, even a fully updated system was no protection. Awesome Motive has cleaned up the CDN files, rotated the API key, and migrated the marketing website to new infrastructure.

What the vendor says

"An attacker exploited a known vulnerability in a third-party plugin (UpdraftPlus) to gain access to the server of our marketing website. This server is completely separate: a different hosting environment, different infrastructure from the application servers that run OptinMonster and TrustPulse and store customer data. On the marketing server, the attacker found an API key for our CDN account. […] We have since cleaned up the marketing site, migrated it to a new server, and rotated all credentials, including the CDN API key." – Awesome Motive (OptinMonster/TrustPulse)

For PushEngage, the vendor stresses that the application servers, the source code and the systems holding the account data are hosted separately and were not compromised.

GDPR: your obligations as a website operator

Here lies a crucial point for German companies: The notification obligation applies to you as the website operator (controller), not to Awesome Motive. The fact that the attack occurred via a third party does not release you from responsibility.

Once the backdoor plugin was installed, the attacker potentially had access to all files and the entire database – i.e. customer data, order data, contact form entries, newsletter subscribers. This is a "personal data breach" within the meaning of Art. 4 No. 12 GDPR.

• Notification obligation (Art. 33 GDPR): In the event of a data breach, you must report it without undue delay, ideally within 72 hours of becoming aware, to the competent state data protection authority – unless a risk to the rights and freedoms of natural persons is unlikely. In the case of unauthenticated code execution, a significant risk must be assumed.
• Notification of affected persons (Art. 34 GDPR): In the case of a high risk, the affected persons must also be informed without undue delay.
• Documentation obligation (Art. 33 (5) GDPR): Even without a notification obligation, the incident must be documented internally.
• Fine risk (Art. 83 GDPR): Violations of technical protection obligations can be penalised with up to EUR 10 million or 2% of global annual turnover, more serious violations with up to EUR 20 million or 4%.

Context: why this case is so dangerous

The incident is to be classified as critical – for several reasons: the attack surface is enormous, with 1.2 million potentially affected sites. The backdoor is not detectable by those affected without active checking. An updated WordPress offered no protection. And the exploitation is really documented. Especially for small and medium-sized businesses that use conversion plugins like OptinMonster and rarely have dedicated security resources, this is a serious threat.

For reassurance: if you do not use any of the three plugins, or if no administrator was logged in during the short exposure window, your risk is low.

Conclusion

This attack reveals an uncomfortable truth: even those who do everything right and keep their software up to date can be hit via the supply chain. The best protection consists of several layers – up-to-date plugins, 2FA, minimal admin rights, server-side monitoring and, where possible, technical safeguards such as SRI and CSP for external scripts.

Act now: Update UpdraftPlus, check your user and plugin folders in the file system, run a server-side malware scan – and document the process in case a GDPR-relevant notification becomes necessary. If you are unsure whether your website is affected or how to clean it up safely, seek professional support. A clean backup and a thorough scan are considerably cheaper here than a fine and reputational damage.