A threat actor purchased the EssentialPlugin WordPress plugin suite in mid-2025 and embedded a dormant backdoor across more than 30 plugins, activating it months later to inject SEO spam, malicious redirects, and fake pages into affected websites. The attack targets hundreds of thousands of WordPress installations, with the malicious payload designed to activate only for search engine crawlers, rendering the payload invisible to site owners during normal browser inspection, allowing the compromise to persist undetected. WordPress.org has issued a forced update that neutralizes the primary command-and-control path, but a malicious entry in wp-config.php persists on every affected site and requires manual removal, meaning most affected sites remain partially compromised today.