CERT24Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites
An attacker tampered with JavaScript files used by PushEngage, OptinMonster, and TrustPulse. When a logged-in WordPress administrator loaded a file, it created an attacker-controlled administrator account and installed a hidden backdoor plugin.