{"id":"CVE-2026-6443","aliases":["EUVD-2026-23384","GHSA-c8jg-hc58-jrx2"],"status":"published","title":"Essentialplugin Plugins (Various Versions) - Injected Backdoor","description":"All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00495,"percentile":0.42752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-506"],"published":"2026-04-17T06:44:49Z","modified":"2026-10-26T21:10:00Z","products":[{"vendor":"essential plugin","product":"featured post creative"},{"vendor":"essential plugin","product":"meta slider and carousel with lightbox"},{"vendor":"essential plugin","product":"portfolio and projects"},{"vendor":"essentialplugin","product":"accordion and accordion slider"},{"vendor":"essentialplugin","product":"album and image gallery plus lightbox"},{"vendor":"essentialplugin","product":"blog designer – post and widget"},{"vendor":"essentialplugin","product":"countdown timer ultimate"},{"vendor":"essentialplugin","product":"featured post creative"},{"vendor":"essentialplugin","product":"meta slider and carousel with lightbox"},{"vendor":"essentialplugin","product":"popup maker and popup anything – popup for opt-ins and lead generation conversions"},{"vendor":"essentialplugin","product":"portfolio and projects"},{"vendor":"essentialplugin","product":"post grid and filter ultimate"},{"vendor":"essentialplugin","product":"post ticker ultimate"},{"vendor":"essentialplugin","product":"team slider and team grid showcase plus team carousel"},{"vendor":"essentialplugin","product":"testimonial grid and testimonial slider plus carousel with rotator widget"},{"vendor":"essentialplugin","product":"timeline and history slider"},{"vendor":"essentialplugin","product":"trending/popular post slider and widget"},{"vendor":"essentialplugin","product":"video gallery and player"},{"vendor":"essentialplugin","product":"wp blog and widgets"},{"vendor":"essentialplugin","product":"wp featured content and slider"},{"vendor":"essentialplugin","product":"wp logo showcase responsive slider and carousel"},{"vendor":"essentialplugin","product":"wp news and scrolling widgets"},{"vendor":"essentialplugin","product":"wp responsive faq with category plugin"},{"vendor":"essentialplugin","product":"wp responsive recent post slider/carousel"},{"vendor":"essentialplugin","product":"wp slick slider and image carousel"},{"vendor":"unknown","product":"wp blog and widgets"},{"vendor":"wp onlinesupport, essential plugin","product":"timeline and history slider"},{"vendor":"wp onlinesupport, essential plugin","product":"trending/popular post slider and widget"},{"vendor":"wponlinesupport","product":"album and image gallery plus lightbox"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve"},{"url":"https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6443"},{"url":"https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them"},{"url":"https://github.com/advisories/GHSA-c8jg-hc58-jrx2"}],"sources":{"cve":[{"id":"CVE-2026-6443","title":"Essentialplugin Plugins (Various Versions) - Injected Backdoor","description":"All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.","status":"published","published":"2026-04-17T06:44:49.128Z","modified":"2026-04-21T19:53:07.705Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-23384","description":"All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.","status":"published","published":"2026-04-17T06:44:49Z","modified":"2026-04-21T19:53:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:21.512647Z"}],"ghsa":[{"id":"GHSA-c8jg-hc58-jrx2","title":"The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in...","description":"The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in version 1.4.6. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.","status":"published","published":"2026-04-17T09:31:18Z","modified":"2026-04-17T09:31:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T15:07:31.795355Z"}],"nvd":[{"id":"CVE-2026-6443","description":"All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.","status":"published","published":"2026-04-17T07:16:03.16Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:12:15.120927Z"}]}}