For years the advice for WordPress owners was simple: keep everything updated. In 2026, several incidents showed that this advice is no longer enough on its own. In some cases the update itself was the problem, either because a plugin had quietly changed owners or because the vendor's own update system was hijacked. The practical answer is to know who owns the plugins on your site, and to have fewer of them.

This article explains what happened in plain language, why prompt updating did not protect everyone, and what a small business or organisation can do about it without becoming a security expert.

In short

  • A supply-chain attack hits you through software you already trust, such as a plugin you installed from a legitimate source.
  • In 2026, reports describe plugins bought and backdoored after a sale, and vendor update pipelines compromised so that official updates carried malware.
  • Updating promptly is still sensible, but it is not enough. Knowing who maintains each plugin, removing what you do not use, and testing updates before they go live all reduce your exposure.
  • A leaner site with fewer third-party plugins, plus someone responsible for maintenance, has fewer places for this to happen.

What is a plugin supply-chain attack?

A plugin supply-chain attack is when attackers get malicious code into a plugin before it reaches your website, so that your normal update process installs it for you. Instead of breaking into thousands of sites one by one, the attacker compromises one source and lets the update system do the distribution.

What happened to the Essential Plugin portfolio?

A large group of plugins was bought through the Flippa marketplace and then backdoored. The Next Web reports that a portfolio of more than 30 plugins from a vendor called Essential Plugin was sold to a buyer identified only as "Kris", and that WordPress.org closed 31 plugins from that author on 7 April 2026.

Patchstack's analysis adds the technical picture. According to Patchstack, the new owner's first update in 2025 planted a hidden weakness, and it stayed dormant for about seven months before being activated on 5 April 2026. It could then be used to write files onto the website. Patchstack lists 22 affected plugins, and its own article uses different totals in different places, so treat exact counts with care. The sources also differ slightly on the month the code was added in 2025.

The plugins had been genuine before the sale, and sites that updated in the meantime received the hidden code. The Next Web reports that the injected code was designed to show spam content only to search engines, so site owners saw nothing unusual.

What happened with vendor update pipelines?

In these cases the plugin company kept its owner, but attackers got into the systems that build and deliver updates. Two examples from 2026:

  • Smart Slider 3 Pro. mySites.guru reports that an unauthorised party reached the vendor's update infrastructure and published a backdoored build, 3.5.1.35, as a normal update. Version 3.5.1.36 is the clean replacement. The Next Web describes the bad version as available for about six hours. Reports differ on exact dates, so check the vendor's advisory for your own site.
  • ShapedPlugin Pro plugins. BleepingComputer reports that three paid plugins (Real Testimonials Pro, Product Slider Pro for WooCommerce and Smart Post Show Pro) were tampered with through the vendor's update channel. It says the free versions on WordPress.org were not affected, and that the malware tried to steal credentials and remote access details. OffSeq's threat page summarises the same incident and cites Wordfence as confirming it.

Why is updating promptly not enough?

Updating promptly protects you from known flaws, but it cannot protect you when the update itself is the attack. If you installed the bad version the day it was released, you were as exposed as someone who waited, and in some of these cases the early updaters were the ones affected.

That does not mean "never update", because delay leaves known holes open. Update deliberately: with a backup, on a test copy first where possible, and with someone watching news about your key plugins.

If you want to know what a cleanup looks like once something has gone wrong, I covered that in why deleting the bad plugin doesn't clean a hacked WordPress site.

How do I check if my plugins are safe?

You cannot prove a plugin is perfectly safe, but you can check the warning signs. Start by listing every plugin, then review each one against this table.

Check What to look for If it looks wrong
Still used? Does a visible feature depend on it? Deactivate and delete it
Last updated Several months with no update, or "not tested with your WordPress version" Find an alternative or replace it
Ownership Has the author or company name changed recently? Does the plugin page mention a sale? Research it before the next update
Source Installed from WordPress.org or the vendor, with a valid licence Remove any nulled or "free premium" copy
Closed or removed Has WordPress.org closed it? Replace it and have the site checked

Pay particular attention to nulled plugins, which are paid plugins shared illegally for free. They bypass the vendor entirely, so you have no idea who has modified them.

What should I do this week?

A short routine goes a long way:

  1. Make an inventory. Write down every plugin, its purpose and who is responsible for it.
  2. Remove what you do not use. Deactivated plugins can still be a risk, so delete them.
  3. Check ownership and activity. Look at the plugin page for the author, last update date and active installs, and be cautious when any of them changes suddenly.
  4. Back up before every update. Keep the backup away from the web server, and test a restore at least once.
  5. Stage updates where you can. Try them on a copy of the site first, and do not update on a Friday evening.
  6. Follow advisories for your key plugins. Security firms such as Patchstack and Wordfence publish them.

Why does a leaner site lower the risk?

Every plugin is a separate supplier you are trusting with the keys to your website. A site with 40 plugins has 40 companies, owners and update pipelines that could go wrong. A site built with a lean structure and only the extras it truly needs has far fewer.

A custom-built or carefully scoped site can replace many small plugins with a few features written for your actual use. It is not automatically immune, because custom code needs maintenance too. The advantage is that you know what is on the site and who is responsible for it. A maintenance plan then gives that responsibility a name: someone who checks updates, backs up, monitors and responds.

Questions to ask your web person

  • Do we have a current list of all plugins, with the owner and purpose of each?
  • Which plugins are paid, and are the licences held in our name?
  • How do you decide when to apply an update, and do you test it first?
  • Where are the backups stored, and when did we last test a restore?

Frequently asked questions

Should I stop updating WordPress plugins? No. Most updates fix genuine security problems. Instead of stopping, update with a backup in place, test first if you can, and keep the number of plugins small.

How can I tell if a plugin has been sold to a new owner? Look at the author name and website on the plugin page, the recent changelog and any sudden change in support behaviour. Ownership changes are not always announced, which is why a regular review matters.

Are paid plugins safer than free ones? Not automatically. Some of the 2026 incidents involved paid Pro versions delivered through the vendor's own update channel. Safety depends on how well the vendor protects its systems and how actively it is maintained.

Does a security plugin or firewall fix this? It can help, but it is an extra layer rather than a cure. A trusted plugin that arrives through an official update may not look suspicious to a scanner at first, so inventory, backups and monitoring still matter.

Where I can help

I'm Rahim, founder of Chillo Creative. If you are not sure what your website is running, a calm first step is to look at it together. The free Digital Business Audit reviews your website setup in plain language, with no pressure. If you are planning a new site or a rebuild, my website work focuses on a lean build around your business, and includes 12-Month Post-Launch Support so that updates, backups and maintenance have a clear owner after launch.

Sources