Published November 5, 2026
Short answer. On a site running Health Score, the first warning would have been an email between
12 and 16 May 2025 saying that the plugin’s contributors had changed: one new account, essentialplugin,
in place of everyone listed before. That is about 12 weeks before the backdoored version shipped and
about 46 weeks before the backdoor was switched on. The plugin’s grade would have stayed “Healthy”, and
nothing in Health Score reads code, so the email was the whole warning.
- Late 2024 – early 2025The business is sold through Flippa.
- 12–16 May 2025Health Score emails: contributors changed for all 31 plugins.
- 8 Aug 2025Version 2.6.7 ships the backdoor. Health Score sends nothing new.
- 5–6 Apr 2026The backdoor is switched on.
- 7 Apr 2026WordPress.org closes all 31 plugins. Health Score emails: closed, security issue.
Source: Anchor Hosting, TechCrunch, our replay
What happened
The Essential Plugin portfolio (formerly WP Online Support) had 31 free plugins on WordPress.org. Public reporting by Anchor Hosting and TechCrunch gives this timeline:
| Date | Event |
|---|---|
| Late 2024 – early 2025 | The business is sold through Flippa. |
| 12 May 2025 | A new WordPress.org account, essentialplugin, gets commit access to the plugins. |
| 8 Aug 2025 | Version 2.6.7 ships a backdoor, under the changelog line “Check compatibility with WordPress version 6.8.2”. |
| 5–6 Apr 2026 | The backdoor is activated and starts injecting code into sites. |
| 7 Apr 2026 | WordPress.org closes all 31 plugins (reason: security issue). |
| 8 Apr 2026 | WordPress.org pushes an update that disables the backdoor. |
What Health Score would have shown
We replayed the public record of all 31 plugins (every commit and every version of each readme in the WordPress.org Subversion repository) through Health Score’s own code, for a site with the plugins installed and Health Score checking once a day from 1 November 2024.
| When | What the site owner would have received |
|---|---|
| 12 May 2025 (1 plugin), 14 May (6), 15 May (20¹), 16 May (4) | Email: “contributors changed on WordPress.org. Added: essentialplugin. Removed: …” and every previous contributor, for all 31 plugins. The change also showed on the Health Score screen until acknowledged. |
| 8 Aug 2025 | Nothing new. The backdoored 2.6.7 was an ordinary update. |
| 7 Apr 2026 | Email: “closed on WordPress.org. Reason: Security Issue.” Grade Closed (0), and a critical Site Health warning for every active one. |
The signal was not lost in noise: in the six months before the sale, the same 31 plugins produced
3 contributor alerts in total. Archived copies of the plugin pages confirm the timing on their own: they
list the old team up to 12 May 2025 and only essentialplugin from then on.
¹ One archived page of Portfolio and Projects, from 15 March 2025, shows the plugin as closed. No other source confirms it, so we leave it out. If it were real, that plugin would have shown a closure alert in March 2025 and its contributor alert on 1 June 2025.
What it would have missed
- The backdoor itself. Health Score reads public WordPress.org data, not plugin code. It cannot tell a harmless update from a malicious one.
- The grade. All 31 plugins stayed “Healthy” (90 of 100) from the sale until the closure, because a contributor change only takes 10 points off. An email and a “Healthy” grade send mixed messages; we are changing how much an unreviewed change of hands counts.
- The commit access. The earliest public sign, a new account committing to the plugin, is not exposed by the WordPress.org API, so Health Score cannot see it. In this case the readme changed within four days, but a buyer could leave it alone.
- The owner field. WordPress.org also lists a plugin owner, and Health Score alerts when it changes. Its history cannot be replayed: no archived copies of the WordPress.org API answers exist for these plugins. So this replay shows only the contributors signal, not whether an owner alert would also have fired.
Update Watch would have logged the 2.6.7 update, with the changelog line “Check compatibility with WordPress version 6.8.2”, and sent no alert: the site kept working.
How we tested
The replay feeds each day’s reconstructed WordPress.org answer into Health Score’s own classes (the API reader, the checker that detects closures and contributor changes, and the scorer). It does not use a re-implementation. The Contributors line comes from the readme in Subversion. The live API reads the readme of the released version, which can lag behind by a release. Support-forum data is not available historically and is left out. The replay scripts and the raw data will be published with the plugin source code. Until then, ask us for them at hello@plugevity.com.
Questions
Could Health Score have stopped the Essential Plugin backdoor?
No. Health Score does not read plugin code and never blocks an update. In a replay of the public history, it would have emailed a site owner between 12 and 16 May 2025 that the plugin's listed contributors had been replaced by a new account, about 12 weeks before the backdoored version shipped. Acting on that email, for example by holding updates and reviewing the next one, was up to the owner.
How can I tell if a WordPress plugin changed owner?
WordPress does not tell you. Two public signals change when a plugin is sold, the owner account on the WordPress.org plugin page and the Contributors line in its readme. Health Score stores both for every installed plugin and emails you when either one changes.
Were the Essential Plugin plugins closed on WordPress.org?
Yes. WordPress.org closed all 31 on 7 April 2026 for a security issue and pushed an update that disabled the backdoor on 8 April 2026, according to Anchor Hosting. A closed plugin gets no more updates through WordPress.org.
The plugins in this case
Health Score: Know which of your plugins are built to last.
Update Watch: Know within minutes when an update breaks your site.