OptinMonster, TrustPulse and PushEngage WordPress plugins backdoored in Awesome Motive CDN supply-chain attack

On 13 June 2026, security firm Sansec disclosed a supply-chain attack against Awesome Motive, the company behind a portfolio of widely used WordPress marketing plugins. Attackers had tampered with JavaScript files distributed through Awesome Motive's content delivery network (CDN), poisoning the scripts loaded by the OptinMonster, TrustPulse and PushEngage plugins — OptinMonster alone is installed on at least 1.2 million websites.

What happened

The intruders first exploited a known vulnerability in a third-party plugin, UpdraftPlus, running on one of Awesome Motive's marketing website servers. From there they accessed the server, located credentials for the company's CDN account, and used the stolen CDN API key to modify JavaScript files served to plugin users. Because the scripts were loaded directly from the legitimate CDN, affected WordPress sites silently pulled the malicious code without any local file change.

The injected JavaScript was designed to execute inside the browser of any logged-in WordPress administrator who loaded an affected page. Riding that administrator's own authenticated session, the code silently created hidden administrator accounts and installed a self-hiding backdoor plugin — handing the attackers persistent, privileged access to compromised sites. Awesome Motive said the tampered scripts were served for a short period starting 12 June: OptinMonster and TrustPulse were affected briefly that evening, while some PushEngage CDN nodes kept serving the malicious payload until around 19:02 UTC on 14 June.

Why it matters

This was a classic CDN supply-chain compromise: a single stolen API key turned trusted, centrally hosted scripts into a delivery channel for backdoors across potentially over a million sites, with no malicious file ever written to the victim servers themselves. Because the payload weaponised the session of whichever administrator happened to load it, detection and clean-up are harder than a conventional plugin update hack. Awesome Motive said it remediated the marketing site, migrated it to a new server and rotated all credentials including the CDN API key, but site owners running the affected plugins were urged to audit for unexpected administrator accounts and unknown plugins.