WordPress Supply-Chain Attacks 2026: What Site Owners Do Now
A plain-English guide to the June 2026 WordPress supply-chain attacks, the compromised plugins, and why cleaned sites keep reinfecting until you close the access.
If your WordPress site started behaving strangely in June 2026, redirecting visitors, spraying spam, or getting flagged by Google, you were not alone, and it probably was not your fault.
Through mid-2026 the WordPress ecosystem took a run of hits at the same time. Not one plugin bug, but several at once, including two that poisoned trusted software at the source before it ever reached your site.
That is what makes this wave different, and more dangerous, than the usual patch-and-move-on advisory.
The worst part comes after the attack. Site owners clean the malware, breathe out, and watch the same infection reappear a day later. We see this constantly, and there is a specific reason for it that most coverage skips.
This is the guide we wish existed while it was happening: what broke, which plugins were involved, and why a clean does not stick until you do one more thing.
What actually happened in June 2026
Most WordPress hacks are opportunistic. An attacker scans millions of sites for a known flaw and exploits whoever forgot to update.
The June 2026 wave had that, but it also had something rarer: two supply-chain attacks, where the malicious code was slipped into legitimate plugins before they were distributed.
Supply-chain attack
An attack that compromises trusted software at its source, so the malicious code arrives through a normal, signed update rather than by breaking into your site directly.
When the software itself is poisoned, doing everything right does not save you. You updated on schedule, you trusted a reputable vendor, and the update carried the payload in.
That is a hard idea to sit with, because the standard security advice is "keep everything updated". In a supply-chain attack, the update is the delivery mechanism. Good hygiene still matters enormously, but it stops being a guarantee, which changes how you have to think about recovery.
Here is the shape of the month.
Awesome Motive CDN compromise
Malicious JavaScript is injected via the content-delivery network serving popular plugins including OptinMonster, TrustPulse and PushEngage, reaching sites that had done nothing wrong.
ShapedPlugin Pro build pipeline hit
A compromised build pipeline ships tainted plugin releases, later tracked as CVE-2026-10735 and CVE-2026-49777.
Mass exploitation of critical flaws
Attackers automate exploitation of severe bugs in Kirki (CVE-2026-8206), Gravity SMTP (CVE-2026-4020), Breeze and Avada.
The reinfection wave
Cleaned sites start reappearing in infection reports because the attackers kept their access, not just their malware.
The Awesome Motive CDN supply-chain attack
Awesome Motive is one of the largest plugin companies in the WordPress world. Its products sit on millions of sites, which is exactly what made it a target.
The attack did not break into each site one by one. It compromised the content-delivery network, the CDN, that serves scripts for popular tools including OptinMonster, TrustPulse and PushEngage.
Content Delivery Network
/siː diː ɛn/
A network of servers that delivers files like scripts and images quickly by serving them from a location near each visitor.
Because your site loaded those scripts from a trusted source, the malicious JavaScript ran in visitors' browsers as if it belonged there. No login was needed on your end, and nothing looked wrong in your dashboard.
That browser-side detail matters for how you check. Many owners ran a server malware scan, saw nothing, and assumed they were clear. But a CDN-injected script does not have to touch your server files at all. It runs in the visitor's browser, which is why the damage shows up as redirects, injected pop-ups or skimmed form data rather than obviously modified files.
This is the uncomfortable lesson of the Awesome Motive CDN attack: a plugin you never touched, from a vendor you were right to trust, can still be the thing that carries an attack onto your pages. It is a close cousin of how a compromised site quietly drags down performance and revenue before you ever notice a security problem.
The ShapedPlugin Pro build-pipeline compromise
The second supply-chain attack hit ShapedPlugin, and it worked a level deeper.
Here the build pipeline, the automated system that packages a plugin into the file you download, was compromised. So the tainted code was baked into official releases and later catalogued as CVE-2026-10735 and CVE-2026-49777.
Common Vulnerabilities and Exposures
A public catalogue that gives each disclosed security flaw a unique tracking ID, so everyone can refer to the same issue.
A build-pipeline compromise is the hardest kind to spot as a site owner. The download came from the right place, the version number looked normal, and the update installed cleanly. There is no visible signal that the file you received differs from the one the developer intended to publish.
If you run a ShapedPlugin Pro product, treat any version released in the affected window as suspect. Roll forward to a vendor-confirmed clean release rather than assuming the malicious build simply overwrote itself, and read the vendor's own disclosure to confirm which version numbers are safe.
The critical plugin flaws being mass-exploited
Alongside the two supply-chain attacks, attackers were mass-exploiting a set of severe, separately-discovered bugs. These are ordinary vulnerabilities, but the automation hitting them in June 2026 was anything but ordinary.
If your site runs any of these, patching is not optional and it is not something to leave for the weekend.
The June 2026 mass-exploited plugins
| Feature | Plugin | What the flaw allows |
|---|---|---|
| Kirki (CVE-2026-8206) | Theme customiser framework | Critical option manipulation leading to takeover |
| Gravity SMTP (CVE-2026-4020) | Email delivery | Credential and email-flow abuse |
| Breeze | Caching | Exploited for code execution paths |
| Avada | Theme and builder | Widely-installed attack surface under active attack |
The common thread is reach. Kirki ships inside countless themes, Avada is one of the best-selling themes ever, and Gravity SMTP touches the email that carries your password resets. A flaw in widely-installed software is worth automating, because one exploit works on thousands of sites.
Kirki is the sneaky one, because it is a framework bundled inside other themes rather than something you installed by name. You can be running a vulnerable version without ever having chosen it, which is why the affected-plugins list on this wave was longer than the download counts alone suggest.
One thing needs saying plainly, because it is easy to read the list above the wrong way. The plugins named here are the headline campaigns that made the security press, not the full catalogue of what was being exploited.
Around 250 new WordPress plugin vulnerabilities are disclosed every week, and exploitation now starts within hours of a flaw going public.
So if you do not run Kirki, Gravity SMTP, Breeze or Avada, you have ruled out those particular doors, not the attacker. The larger malware operations rotate through whichever freshly-disclosed flaw is easiest that week, and once they are inside, their hold on your site does not depend on any single plugin.
That is why we treat the named plugins as a starting point for the investigation, not the boundary of it. If your stack contains none of them and you are still being hit, the vector is almost certainly a different flaw, and the recovery steps below matter more, not less.
Patch the widely-installed plugins first. Attackers prioritise flaws in software that sits on the most sites, because a single working exploit scales. Your update order should mirror theirs.
How to tell if your site was hit
Before you start cleaning, it helps to know what you are looking for. The June 2026 attacks left a fairly consistent set of fingerprints.
Common signs of compromise
- Unexpected redirects, where visitors, and especially mobile visitors, land on a page you never built.
- A Google Search Console warning about deceptive content, or a sudden drop in impressions.
- New admin users or posts you do not recognise appearing in your dashboard.
- Outbound spam, or a hosting notice that your account is sending unusual volumes of email.
- Files with recent modification dates in wp-content that nobody on your team touched.
Any one of these is worth a proper look. Two or more together, in the June to July window, and you should assume compromise and work through the recovery steps below rather than hoping it clears itself.
Do not rely on the site "looking fine" on your own screen. Attackers often cloak the payload so it only fires for search-engine crawlers or first-time visitors, which means the owner logged in every day sees nothing wrong for weeks.
Why your site keeps reinfecting after you clean it
This is the part almost nobody explains, and it is the reason so many owners spent late June cleaning the same site twice.
Cleaning malware removes the payload: the visible files, the injected code, the redirect. It does not remove the attacker's access.
Those are two different things, and the gap between them is where reinfection lives.
When an attacker gets in, they rarely just drop malware and leave. They establish ways back in that survive a clean-up:
What a payload clean leaves behind
- A hidden admin account created during the breach, sitting quietly in your user list until it is needed again.
- A backdoor hidden in a plausible-looking plugin folder or theme file, waiting to re-download the malware.
- Stolen credentials for admin logins, database access or API keys that let the attacker walk back in through the front door.
- Self-rewriting malware that regenerates deleted files from a process still running on the server.
So the sequence goes like this. You delete the bad files. The site looks clean. Hours later the retained access reactivates, re-downloads the payload, and you are back where you started.
That is not a failed clean-up. It is a clean-up that stopped one step too early.
The self-rewriting behaviour trips up even careful people. If you delete a malicious file and it reappears within seconds, you are not imagining it. A process running on the server is watching for the deletion and rewriting the file, which means you cannot win by racing it in the file manager.
How to find hidden admin accounts and backdoors
The good news: the access an attacker leaves behind is findable if you know where to look. Here is where we start on a reinfecting site.
Audit every administrator account
In your dashboard, filter Users by the Administrator role and read the list line by line. Look for accounts you do not recognise, odd usernames, or addresses on domains you have never used. A hidden admin is the fastest way back in for an attacker, so this is step one.
Cross-check the database, not just the dashboard
Sophisticated attackers hide admin accounts from the dashboard user list while keeping them active in the database. If a reinfection persists after the visible users look clean, the account count in the wp_users table should match what you see on screen. A mismatch is a red flag.
Compare plugin and theme files against known-good copies
A backdoor usually hides in a folder that looks legitimate. Compare your plugin and theme files against fresh copies from the official source and investigate anything that does not match, especially recently-modified files you did not change.
Rotate every credential the attacker could have touched
Change all admin passwords, database credentials, hosting and FTP logins, and any API keys or SMTP credentials. Stolen credentials let an attacker return without any malware at all, so treat every secret as burned.
Force a logout of all active sessions
Resetting passwords does not always kill a session that is already open. Invalidate all sessions so an attacker who is currently logged in is thrown out rather than left connected.
The self-rewriting malware is the trickiest of the lot. If files keep regenerating the instant you delete them, a malicious process is still running, and you cannot win the fight file-by-file. That is the point to take the site offline, or ask your host to, so nothing is executing while you clean.
Your first-72-hours recovery checklist
If you are in the middle of this right now, work in order. Do not skip the access steps to get the site back up faster, because that is exactly what produces the second infection.
- Take a forensic backup before you change anythingYou may need it as evidence of what was altered
- Update every plugin and theme to a vendor-confirmed clean releaseEspecially Awesome Motive, ShapedPlugin, Kirki, Gravity SMTP, Breeze and Avada
- Audit all administrator accounts and delete any you cannot account for
- Cross-check the user count in the database against the dashboard
- Compare plugin and theme files against official copies and remove backdoors
- Rotate every password, database, hosting and API credential
- Invalidate all active sessions
- Re-scan, then re-scan again 48 hours later to confirm it holds
One more housekeeping job once the fire is out: confirm your sitemap and search-console setup are clean, because compromised sites are often used to inject spam URLs. Keeping your XML sitemap accurate helps you spot pages you never created, which is a useful early warning that something is still wrong.
How to reduce the blast radius next time
You cannot stop a supply-chain attack from your dashboard. What you can do is shrink how much damage one gets to cause and how quickly you find out.
Sensible defaults after this wave
- Cut your plugin count. Every plugin is a supply chain you are trusting. Remove anything you are not actively using.
- Keep offsite backups you can actually restore. A clean copy from before the breach turns a crisis into an afternoon.
- Turn on file-change monitoring. The faster you learn a file was modified, the smaller the window an attacker gets.
- Use unique admin logins with two-factor. Stolen credentials are useless to an attacker who also needs a second factor.
- Review your users on a schedule. A monthly glance at the admin list catches a hidden account before it is used.
None of this is glamorous, and none of it is new. It is the difference between spending a week firefighting and spending an hour patching, which is a trade worth making before the next wave rather than during it.
The takeaway
June 2026 was a reminder that trusting reputable software is reasonable, and still not a guarantee. Supply-chain attacks turn a normal update into the delivery method, which is not something an individual site owner can prevent.
What you can control is the recovery. Patch to clean releases, then hunt the access, not just the payload. Close the hidden admins, the backdoors and the stolen credentials, and the reinfection loop ends.
Clean the files and you win a day. Close the access and you keep the site.
People also ask
Why does my WordPress site keep getting reinfected after cleaning?
Because cleaning removes the malware payload but not the attacker's access. Hidden admin accounts, backdoors in plugin or theme folders, stolen credentials and self-rewriting malware all survive a file clean-up, then reinstall the payload within hours. Recovery only sticks once you close every route back in, not just the visible infection.
What is the Awesome Motive CDN supply-chain attack?
In early June 2026 the content-delivery network serving several popular Awesome Motive plugins, including OptinMonster, TrustPulse and PushEngage, was compromised to inject malicious JavaScript. Because sites loaded those scripts from a trusted source, the code ran in visitors' browsers with no break-in on the site itself, so a server-side scan could miss it.
How do I find hidden admin accounts on WordPress?
Filter your Users list by the Administrator role and review every account, deleting any you cannot identify. Sophisticated attacks hide accounts from the dashboard while keeping them in the database, so also compare the user count in the wp_users table against what the dashboard shows. A mismatch means an account is hidden from view.
Which WordPress plugins were compromised in 2026?
The June 2026 wave involved Awesome Motive plugins hit via a CDN attack (OptinMonster, TrustPulse, PushEngage), ShapedPlugin Pro through a build-pipeline compromise (CVE-2026-10735 and CVE-2026-49777), plus mass exploitation of critical flaws in Kirki (CVE-2026-8206), Gravity SMTP (CVE-2026-4020), Breeze and Avada.
Treat those as the named headline campaigns rather than a complete list. Roughly 250 plugin vulnerabilities are disclosed every week, so running none of them does not mean you were safe. If you were hit and none of these are in your stack, the entry point was almost certainly a different flaw.
How do I fully remove a WordPress backdoor?
Compare all plugin and theme files against fresh official copies and remove anything that does not match, then rotate every credential, invalidate all sessions and delete unrecognised admin accounts. If files regenerate as you delete them, a malicious process is still running, so take the site offline and get server-level help from your host or a specialist.
Further reading
- WordPress Vulnerability & Threat IntelligenceWordfence
- Patchstack WordPress Vulnerability DatabasePatchstack
- CVE Program: search disclosed vulnerabilitiesMITRE CVE
- Hardening WordPressWordPress.org Developer Docs
