All WordPress plugins produced by Essentialplugin for WordPress have been found to contain an injected backdoor in various versions. The backdoor was introduced by a malicious threat actor who bought the plugins and inserted code that grants persistent access to the compromised sites. This represents a CWE‑506 vulnerability that allows attackers to persistently control the site, inject spam, or perform other malicious actions, thereby compromising site integrity and potentially extending to other vulnerable assets.

All WordPress plugins developed by Essentialplugin, across multiple versions, are affected. The list of vulnerable products includes Accordion and Accordion Slider, Album and Image Gallery Plus Lightbox, Blog Designer – Post and Widget, Countdown Timer Ultimate, Featured Post Creative, Meta Slider and Carousel with Lightbox, Popup Maker and Popup Anything – Popup for opt‑ins and Lead Generation Conversions, Portfolio and Projects, Post Ticker Ultimate, Post grid and filter ultimate, Team Slider and Team Grid Showcase plus Team Carousel, Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget, Timeline and History slider, Trending/Popular Post Slider and Widget, Video gallery and Player, WP Blog and Widgets, WP Featured Content and Slider, WP Logo Showcase Responsive Slider and Carousel, WP News and Scrolling Widgets, WP Responsive Recent Post Slider/Carousel, WP Slick Slider and Image Carousel, and WP responsive FAQ with category plugin. No specific version numbers are supplied, but any version sold by Essentialplugin may be vulnerable.

With a CVSS score of 9.8, this issue is considered critical. The EPSS score is 0.00044, indicating a very low but nonzero exploitation probability, yet the backdoor appears to have already been deployed in many sites, suggesting a significant exploitation risk. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is straightforward: sites that deploy the compromised plugin are immediately compromised, providing an attacker with a full backdoor and spam capabilities.