A Quiet Sale, A Massive Problem
Earlier this year, a hacker bought a small WordPress plugin company. Not by breaking in, not by phishing anyone. They simply purchased it, the way someone might buy a used food truck or a quiet little storefront. Then they got to work.
The company, known as Essential Plugin, had developed 31 WordPress plugins with a combined install base of over 400,000 sites. Once the sale went through, the new owner pushed malicious code updates to every single one of those plugins. Any WordPress site running these plugins received a backdoor the moment it updated.
Security researcher Austin Ginder uncovered the scheme after a client noticed suspicious third-party access on their site. What he found was one of the more creative attacks on WordPress site owners in recent memory.
What the Backdoor Actually Did
This was not a run-of-the-mill hack. The injected code was sophisticated enough that most site owners had no idea anything was wrong.
The malware connected to a command-and-control server and pulled in spam links, fake pages, and redirects. The clever part: it only served that content to Googlebot, the crawler Google uses to index your site. Visitors to your website saw nothing unusual. You saw nothing unusual. But Google was being shown a completely different, spam-filled version of your site.
That kind of invisible manipulation can quietly tank your search rankings for months before you even realize something is off. For a small business in Honolulu or Kapolei that depends on local search traffic to bring in customers, that kind of damage is real money out the door.
The Blockchain Twist
Here is where it gets genuinely unusual. The malware did not rely on a simple hard-coded server address. Instead, it used an Ethereum smart contract to look up where its command-and-control server was located. That means traditional takedowns, the kind where security teams get a malicious domain shut down, would not work. The attacker could simply update the smart contract to point somewhere new, and the attack would keep running without interruption.
This level of technical sophistication is worth paying attention to. It shows that some attackers are not improvising. They are building systems designed to survive being discovered.
Why WordPress Keeps Ending Up Here
If you have been running a WordPress site for a few years, you have probably accumulated a collection of plugins. Some are active, some are sitting dormant, and honestly, a few you might not even remember installing. That is completely normal, and it is also exactly how situations like this one become a problem for your business.
WordPress's plugin ecosystem is one of its biggest selling points, but it is also one of its biggest liabilities. Any plugin you install is code running on your server, written and maintained by someone you have never met. When that someone sells their company, you have no vote, no say, and often no notice. Your site just updates, and whatever the new owner shipped comes along for the ride.
Over time, a WordPress site that started as a simple brochure for a Kailua restaurant or a Kaneohe contractor can grow into a tangle of plugins, each one a potential entry point. Keeping all of them updated is one layer of protection, but as this incident shows, updates themselves can be the attack.
What You Should Do Right Now
Audit your plugins. Log into your WordPress dashboard and look at every plugin you have installed. If you do not recognize it, look it up. If you are not using it, remove it.
Check against the compromised list. Ginder published the full list of affected Essential Plugin products. If any plugin on your site came from that company, replace it with an alternative and consider a full security scan.
Look at your Google Search Console. If the spam injection was targeting Googlebot, unusual search impressions or pages you do not recognize in your index can be a signal that something went wrong.
Think about who is watching your site. Most small business owners do not have the time to monitor plugin changelogs, security advisories, and Google index reports. That is not a criticism; you are running a business. But someone should be watching.
The Stronger Fix: Getting Off WordPress Entirely
We work with a lot of Oahu business owners who come to us after an incident like this one, or after years of slow performance and mounting plugin debt, and ask whether there is a better way. There is.
We specialize in converting WordPress sites to a modern, serverless architecture built on Cloudflare Pages, Workers, D1, and R2. When your site runs on this kind of stack, there is no plugin ecosystem to compromise, no WordPress core to patch every few weeks, and no database exposed to the internet for attackers to probe. The attack surface shrinks dramatically.
The result is a site that loads faster for visitors in Honolulu and on the mainland, costs less to host over time, and does not require you to stay up to date on which plugin company was quietly sold to a bad actor last month.
It is not the right move for every business in every situation. But if you have been managing a WordPress site for years and security incidents like this one make you nervous, a conversion is worth a serious conversation.
You Should Not Have to Worry About This
Running a small business on Oahu is already a full-time job. Worrying about whether a plugin developer sold their company to someone running a blockchain-powered spam operation should not be part of your week. Good web hosting, regular security monitoring, and the right underlying technology can take most of that off your plate.
If you want to know whether your current site is exposed or whether a move to a more secure stack makes sense for your business, give us a call at (808) 470-7900 or send us a message and request a free audit. We are based right here in Ewa Beach and happy to take a look.