Moatline

The WordPress.org notice about Essential Plugin: how to clean what the update left behind

If your dashboard shows an “Important Notice from the WordPress.org Plugins Team” about the author essentialplugin, one of your plugins was backdoored in April 2026. WordPress.org switched the backdoor off, but it couldn’t remove what was already added to your site. Here is what we found on a site still infected in October, and how to clean it.

By the Moatline team at Next Nova Technologies · Published 27 October 2026 · 5 min read

Worried your site is affected?See what your visitors and Google see. Free, no sign-up, about 20 seconds.
Check my site free

What the notice means

In 2025 someone bought a set of small plugins from their original developer and later added a backdoor to them. It woke up on 5–6 April 2026: the plugins downloaded a file called wp-comments-posts.php (one letter away from the real wp-comments-post.php), and that file wrote spam code into wp-config.php.

On 7 April 2026 WordPress.org closed all 31 plugins, and on 8 April it pushed an update that switches off the part that phones home. That update also added the notice you are seeing. When it ends with “The wp-config.php file contains suspicious content”, the code is still on your site.

The affected plugins

All by the author “Essential Plugin” (formerly WP OnlineSupport):

  • Accordion and Accordion Slider
  • Album and Image Gallery plus Lightbox
  • Audio Player with Playlist Ultimate
  • Blog Designer for Post and Widget
  • Countdown Timer Ultimate
  • Featured Post Creative
  • Footer Mega Grid Columns
  • Hero Banner Ultimate
  • HTML5 VideoGallery Plus Player
  • Meta Slider and Carousel with Lightbox
  • Popup Anything on Click
  • Portfolio and Projects
  • Post Category Image with Grid and Slider
  • Post Grid and Filter Ultimate
  • Preloader for Website
  • Product Categories Designs for WooCommerce
  • Responsive WP FAQ with Category (SP FAQ)
  • SlidersPack – All in One Image Sliders
  • SP News and Widget
  • Styles for WP PageNavi – Addon
  • Ticker Ultimate
  • Timeline and History Slider
  • Woo Product Slider and Carousel with Category
  • WP Blog and Widgets
  • WP Featured Content and Slider
  • WP Logo Showcase Responsive Slider and Carousel
  • WP Responsive Recent Post Slider
  • WP Slick Slider and Image Carousel
  • WP Team Showcase and Slider
  • WP Testimonial with Widget
  • WP Trending Post Slider and Widget

All 31 are on our list of plugins under attack.

What we found in wp-config.php

In October 2026 we cleaned a small business site that still showed the notice six months later. The spam code sat at the end of wp-config.php, right after the line require_once ABSPATH . 'wp-settings.php';. Code placed there runs after WordPress has fully loaded, and real settings never go there. It did this:

  • Hid from the owner. It did nothing for signed-in administrators, in the dashboard, or during cron, WP-CLI, AJAX and REST requests.
  • Showed spam links only to Google. A hidden “More” list of links was added to the footer when the visitor was Googlebot.
  • Redirected chosen pages and changed canonical tags to point Google at the attacker’s sites.
  • Turned 404 pages into spam pages. Addresses that didn’t exist on the site returned a full spam page, served as if it were a normal page.
  • Read its server address from the Ethereum blockchain. When its server stopped answering, it asked a smart contract for a new address, so blocking one domain doesn’t stop it. The default was 0x295bae89192c32[.]com with links. and pages. subdomains.
  • Saved what it fetched in temporary database entries (transients with short names such as _dm, _fc, l, s and p_ plus a long code).

The same site had a second, separate infection: a line at the end of the theme’s functions.php that added an encrypted script to every page for every visitor. It read its address from the Polygon blockchain, the same trick used by the fake CAPTCHA attacks. Someone who can change wp-config.php can change any file, so check the whole site.

Check your site

  1. wp-config.php: download it and open it in an editor with word wrap turned on. Find require_once ABSPATH . 'wp-settings.php';. Anything after its semicolon other than a closing ?> or a simple setting you added yourself is suspect. An infected file is usually about 6 KB larger than normal.
  2. Site root: look for wp-comments-posts.php (with an extra “s”).
  3. Theme files: open your theme’s functions.php and look at the end for a long line that echoes a <script>.
  4. Plugins: check whether any of the 31 plugins above is still installed, even deactivated.
  5. What Google sees: in Search Console, run URL Inspection → Test live URL on your home page and look at the HTML Google got for a list of links you didn’t add.
  6. Search Console users: under Settings → Users and permissions, remove any owner you don’t know.

The free Moatline Malware Scanner 1.3.1 and newer does the first four checks for you: it reports code after the wp-settings.php line, the fake wp-comments-posts.php file, scripts hidden in theme files, and any of the 31 plugins that is still installed.

Clean it up

  1. Back up files and database first.
  2. Delete the Essential Plugin plugin (don’t just deactivate it) and replace what it did with a maintained plugin.
  3. Fix wp-config.php: delete everything after the semicolon of the wp-settings.php line. If you had your own settings after that line, move them above /* That’s all, stop editing! */. Upload the file and check the site loads.
  4. Delete wp-comments-posts.php and any other file you don’t recognise in the site root.
  5. Remove injected theme code, or reinstall the theme from a fresh copy.
  6. Clear the saved spam: with WP-CLI run wp transient delete --all, or use a transients plugin. Then clear your page cache and any caching plugin.
  7. Change every password: WordPress administrators, hosting and SFTP, and the database password (the code could read wp-config.php). Then change the security keys and log everyone out.
  8. Scan the whole site for anything else. See how to remove malware from WordPress.
  9. Ask Google to recrawl your main pages with URL Inspection → Request indexing, and remove spam addresses that now return 404.

Sources: Anchor Hosting’s analysis, mySites.guru and our own cleanup.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

The plugin was updated by WordPress.org. Isn’t that enough?
No. The forced update (version 2.6.9.1) only stops the plugin from fetching new instructions. Code it already put in wp-config.php keeps running until you remove it, and the notice says so.
I can’t see any spam on my site. Am I clean?
Not necessarily. The code hides from signed-in administrators and only shows its spam links to Google’s crawler. Check what Google sees with URL Inspection in Search Console, as described below.
Can I keep using the plugin?
No. All 31 plugins were permanently closed on WordPress.org and get no more updates. Delete it and use a maintained alternative.
Why is my wp-config.php “suspicious” if I never edited it?
The backdoor downloaded a file named wp-comments-posts.php, which wrote a block of code onto the end of the line that loads wp-settings.php. Most editors show it as one very long line, so it is easy to miss.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →