CVE-2026-6443
Full vulnerability record from the local CVENow database.
Description
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2026-04-17 07:16:03.160000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-6443",
"sourceIdentifier": "[email protected]",
"published": "2026-04-17T07:16:03.160",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites."
},
{
"lang": "es",
"value": "Todos los plugins de Essentialplugin para WordPress son vulnerables a una puerta trasera inyectada en varias versiones. Esto se debe a que el plugin fue vendido a un actor de amenazas malicioso que incrustó una puerta trasera en todos los plugins que adquirió. Esto hace posible que el actor de amenazas mantenga una puerta trasera persistente e inyecte correo no deseado en los sitios afectados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "essentialplugin",
"product": "Accordion and Accordion Slider",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.4.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Portfolio and Projects",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.5.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Featured Post Creative",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.5.7",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Post grid and filter ultimate",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.7.4",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP Featured Content and Slider",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.7.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Post Ticker Ultimate",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.7.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Trending/Popular Post Slider and Widget",
"defaultStatus": "unaffected",
"versions": [
{
"version": "1.8.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Meta Slider and Carousel with Lightbox",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.0.8",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Album and Image Gallery Plus Lightbox",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.1.8",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Timeline and History slider",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.4.5",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP Blog and Widgets",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.6.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Countdown Timer Ultimate",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.6.9",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Blog Designer – Post and Widget",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.7.7",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Team Slider and Team Grid Showcase plus Team Carousel",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.8.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Video gallery and Player",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.8.7",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.9.1",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.5.6",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP Responsive Recent Post Slider/Carousel",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.7.1",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP Slick Slider and Image Carousel",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.7.8.1",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP Logo Showcase Responsive Slider and Carousel",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.8.7",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP responsive FAQ with category plugin",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.9.5",
"status": "affected"
}
]
},
{
"vendor": "essentialplugin",
"product": "WP News and Scrolling Widgets",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.0.6",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-17T18:49:32.019393Z",
"id": "CVE-2026-6443",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-506"
}
]
}
],
"references": [
{
"url": "https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/",
"source": "[email protected]"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve",
"source": "[email protected]"
}
]
}