CVE-2026-6443CWE-506

Essentialplugin Plugins (Various Versions) - Injected Backdoor

Critical · published April 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00646 · 50.3th percentile
Weakness
CWE-506 · Embedded Malicious Code
Published
2026-04-17T06:44Z
EPSS history
Timeline
  • 17 APR 06:44Z
    Essentialplugin Plugins (Various Versions) - Injected Backdoor
    cvelistv5