Patchstack reported a supply chain attack affecting OptinMonster, TrustPulse and PushEngage, three marketing tools used on many WordPress sites. The practical problem: the malicious code was served from vendor CDN scripts, not from a normal plugin update. That means a site could be fully updated and still load the tampered JavaScript.
If your site used one of these tools and an administrator visited it during the exposure window around June 12-14, 2026, Patchstack says you should treat the site as potentially compromised and check it manually.
Key Takeaways
- OptinMonster, TrustPulse and PushEngage were affected by tampered CDN JavaScript served to live sites.
- A fully updated WordPress site could still load the malicious script because the change happened at the CDN layer.
- Patchstack points to a risk window around June 12-14, 2026 for sites where an administrator was logged in.
- Check for developer_api1 and dev_xxxxxx administrator accounts.
- Inspect wp-content/plugins directly for hidden backdoors, not only the WordPress dashboard.
Why this was not a normal plugin vulnerability
According to Patchstack, the attacker did not rely on a classic vulnerability inside the OptinMonster, TrustPulse or PushEngage WordPress plugins. The malicious change was added to JavaScript files served from vendor-controlled CDNs, including OptinMonster and TrustPulse api.min.js files and the PushEngage web SDK.
This is the annoying part of supply chain incidents: updating the plugin is not the whole story. The plugin can be current, the dashboard can look boringly normal, and the browser can still receive a bad third-party script.
How the attack used the administrator’s browser
Patchstack says the injected script waited until it was running in the browser of a logged-in WordPress administrator. It then used that administrator’s valid session and nonce to make requests that looked very similar to legitimate admin actions.
The payload tried several paths to create administrator users, including the REST API, the normal user creation form, admin-ajax.php and a hidden iframe. Observed rogue accounts included developer_api1 with customer1usx@gmail.com, plus randomized dev_xxxxxx administrator accounts using matching Gmail-style addresses.
Key indicators of compromise
Patchstack lists several checks worth doing if your site used OptinMonster, TrustPulse or PushEngage during the incident window. Look for administrator accounts named developer_api1 or randomized dev_xxxxxx accounts. Also check for the email customer1usx@gmail.com and randomized dev_xxxxxx@gmail.com addresses.
The backdoor could disguise itself as plugins such as Content Delivery Helper or Database Optimizer. Patchstack also names developer_api1_fm, developer_api1_eval, the domain tidio.cc, and the XOR key jX9kM2nP4qR6sT8v as indicators.
What Patchstack’s logs showed
Patchstack says its mitigation rule blocked 271 exploitation attempts across 13 customer sites between June 14 and June 15, 2026. The attempts came from 81 unique IP addresses, which fits the attack model: the requests were coming from real browsers belonging to logged-in administrators, not just from one obvious attacker server.
Most blocked requests targeted /wp-json/wp/v2/users to create administrator accounts through the REST API. Patchstack also saw attempts through /wp-admin/user-new.php and /wp-admin/admin-ajax.php.
What site owners should do now
If your site used OptinMonster, TrustPulse or PushEngage around June 12-14, 2026, do not stop at checking whether the vendor removed the bad CDN script. That does not remove a rogue admin account or a backdoor that may already have been installed.
- Audit all administrator users and remove anything you do not recognize.
- Look specifically for developer_api1 and randomized dev_xxxxxx accounts.
- Inspect wp-content/plugins/ on the server, not only the WordPress plugins screen.
- Search the codebase for developer_api1_fm, developer_api1_eval and jX9kM2nP4qR6sT8v.
- Run a server-side malware scan if the site was in the risk window.
For the full technical breakdown and current indicators, check Patchstack’s original report: Supply Chain Attack on OptinMonster, TrustPulse, and PushEngage.
Frequently Asked Questions
Was this caused by a normal WordPress plugin vulnerability?
No. Patchstack says the malicious code was added to JavaScript files served from vendor-controlled CDNs, rather than through a traditional vulnerability inside the OptinMonster, TrustPulse or PushEngage plugins.
Could a fully updated WordPress site still have loaded the malicious script?
Yes. Because the change happened at the CDN layer, a site could have current plugins installed and still receive the tampered JavaScript in the administrator’s browser.
Which administrator accounts should site owners look for?
Patchstack lists developer_api1 with customer1usx@gmail.com and randomized dev_xxxxxx administrator accounts with matching Gmail-style addresses as indicators to check.
Where could the backdoor be hidden?
Patchstack says the backdoor could appear as plugins such as Content Delivery Helper or Database Optimizer, so site owners should inspect wp-content/plugins/ directly on the server, not only the WordPress plugins screen.
What dates are most important for checking affected sites?
Patchstack points to an exposure window around June 12-14, 2026, especially for sites using OptinMonster, TrustPulse or PushEngage where an administrator was logged in during that period.