A supply chain attack has compromised popular WordPress plugins through the Awesome Motive content delivery network, affecting more than 1.2 million websites.
The intrusion, attributed to the China-linked group Earth Lusca, injected malicious JavaScript that activates when a WordPress administrator is logged in.
The malicious code was injected into the OptinMonster, TrustPulse and PushEngage plugins via the CDN, as detailed in the Sansec research.
When the script detects an active admin session it creates a rogue administrator account, installs a hidden backdoor plugin and begins exfiltrating authentication tokens and other sensitive data.
No CVE identifiers have been assigned to this flaw because the abuse stems from a compromised distribution channel rather than a traditional vulnerability.
The tainted files were served for only about half an hour before the tampering was detected, limiting the window of exposure but still allowing the attackers to achieve persistence on compromised hosts.
The technique mirrors a 2024 incident that targeted the Polyfill library, showing a recurring pattern of attackers abusing trusted third-party assets.
Earth Lusca, known for targeting sectors ranging from telecom to government, has added supply chain manipulation to its repertoire.
Sansec published indicators of compromise that include unexpected JavaScript strings in plugin files and the appearance of unknown admin accounts in the WordPress user table.
Victims are advised to rotate all administrator passwords and to audit their installations for any unauthorized plugins or users.
Awesome Motive has not issued a public statement about the incident, a silence that has raised concerns among site owners.
Defenders should start by reviewing the file integrity of the OptinMonster, TrustPulse and PushEngage directories, looking for any recent modifications to JavaScript assets.
Any unknown admin accounts must be removed immediately and password policies enforced across all privileged users.
Implementing web application firewalls that block unfamiliar external scripts and enabling content security policy headers can help prevent similar injections in the future.
Regularly updating plugins from trusted sources and limiting the use of third-party CDNs to only those with strong provenance reduces the attack surface.
Monitoring logs for sudden spikes in admin-login events or unexpected plugin activations provides an early warning of compromise.