A hacker bought 30+ popular WordPress plugins and hid backdoors inside them for eight months. If you have a slider, countdown timer, or popup plugin, your site might be compromised. Here’s how to check in 60 seconds and exactly how to clean it up – including a free, safe replacement for the most common affected plugins.
The Essential Plugin Supply Chain Attack: What Every WordPress Owner Needs to Know
A plain English guide to the April 2026 WordPress plugin hack – written for normal website owners, not IT experts.
Imagine you have a trusted babysitter who has a key to your house. One day, that babysitter sells their business to a stranger. You don’t know this happened. The stranger keeps acting like the old babysitter for eight months. Then one night, the stranger uses the key to walk into your house.
That is exactly what happened to hundreds of thousands of WordPress website owners in April 2026.
A hacker bought a large collection of popular plugins (sliders, countdown timers, popups, and more). The hacker added hidden code that looked normal but actually created a secret door into your website. This code sat inactive for eight months – which is why no one noticed. Then in early April 2026, the hacker “turned the key” and started breaking into sites.
The good news: You can check your site in two minutes. The even better news: There is a free, safe replacement for the most common type of affected plugin – the image carousel or slider. I built both a scanner and a replacement plugin to help you clean up your site without needing to be a tech expert.
What The Hacker Can Do On Your Site
Once the hacker has access, they can do almost anything:
- Add fake administrator accounts (so they can come back anytime)
- Inject spam into your pages (that you might not even see, but Google will)
- Redirect your customers to scam websites
- Steal your customer data and email lists
- Use your server to attack other websites
The 60-Second Self Check
Before you do anything else, take 60 seconds to look for these five warning signs:
1. Unknown Admin Users
Go to Users → All Users. Do you see any username you don’t recognize? Pay special attention to usernames that start with “wpsvc_” or “wp_maint_”. These are almost always created by hackers.
2. A Plugin You Don’t Remember Installing
Go to Plugins → Installed Plugins. Do you see any plugin with a name like “WP Responsive Recent Post Slider”, “Countdown Timer Ultimate”, or “Popup Anything on Click”? Check the full list below.
3. Google Warns Your Visitors
Open a private browser window. Go to Google and search “site:yourwebsite.com”. If you see a red warning page that says “This site may be hacked”, your site is compromised.
4. Your Site Redirects To Strange Pages
On your phone (not your computer), try visiting your website. Does it redirect to gambling, pills, or ads? Hackers often hide this from computer users.
5. Password Reset Emails You Didn’t Request
Check the email account for your website admin. Do you see password reset emails you never requested? This often means a hacker is trying to lock you out.
The Complete List of Dangerous Plugins
If you have ANY of these plugins installed, even if they are not active, you need to remove them. These were good, trusted plugins that were sold to a hacker. The hacker added the backdoor later.
Sliders and Carousels (very common on homepages):
- WP Responsive Recent Post Slider
- WP Featured Content and Slider
- WP Slick Slider and Image Carousel
- SlidersPack – All in One Image Sliders
- WP Logo Showcase Responsive Slider and Carousel
- Accordion and Accordion Slider
- Hero Banner Ultimate
- WP Trending Post Slider and Widget
- Meta Slider and Carousel with Lightbox
Popups and Countdowns (very common for email lists and sales):
- Popup Anything on Click
- Countdown Timer Ultimate
- Ticker Ultimate
Testimonials and Team Members:
- WP Team Showcase and Slider
- WP Testimonial with Widget
Post Grids and Blog Displays:
- Post Grid and Filter Ultimate
- WP Blog and Widgets
- Blog Designer for Post and Widget
Other Vulnerable Plugins (not part of the portfolio but also dangerous):
- Burst Statistics (versions below 3.4.2) – authentication bypass
- Kirki Customizer Framework (versions 6.0.0-6.0.6) – privilege escalation
- Smart Slider 3 Pro (version 3.5.1.35) – update-system hack
Introducing The Free SW87 Security Scanner
I built this tool because website owners were panicking, deleting plugins, and breaking their sites. The scanner does three useful things:
- It tells you exactly which dangerous plugins are on your site
- It tells you where those plugins are being used (which pages, which widgets, which theme files)
- It checks for other signs of hacking like backdoor files and fake admin accounts
The scanner does NOT change anything on your site. It only looks. You cannot break your site by running the scanner.
How To Install The Scanner (Takes 2 Minutes)
- Download the plugin using the link at the bottom of this article
- In your WordPress dashboard, go to Plugins → Add New → Upload Plugin
- Choose the file you downloaded and click “Install Now”
- Click “Activate Plugin”
- In your left sidebar, you will see a new menu item called “SW87 Scanner”. Click it.
- Click “Run New Scan”
How To Read The Scanner Results
The scanner uses three colors:
- 🔴 RED (Critical) – A dangerous plugin is ACTIVE on your site. Take action today.
- 🟡 YELLOW (Warning) – A dangerous plugin is installed but not active. The malicious files are still on your server. Remove it.
- 🟢 GREEN (Clean) – No problems found in that category.
If you see a red critical issue, you will also see a button that says “Full Scan”. Click this button. The scanner will now search your entire website to find every single place that dangerous plugin is being used – every page, every post, every widget, every theme file.
This is important because if you just delete the plugin without knowing where it was used, your website will show broken code like “[recent_post_carousel]” instead of your beautiful slider.
A Safe Replacement For Your Sliders And Carousels
The most common type of affected plugin is the image slider or carousel – those scrolling boxes of photos you see on many homepages.
If you are using any of these dangerous slider plugins, you need a replacement. I built the SW87 Carousel plugin as a safe, free alternative.
What Does SW87 Carousel Do?
It displays your posts (or any type of content) in a clean, responsive carousel that works on desktop, tablet, and mobile. You can set it to autoplay, loop forever, and show images, titles, excerpts, author names, and read more buttons.
Why Is SW87 Carousel Safe?
Because I built it from scratch after the hack was discovered. There is no hidden code. No analytics tracking you. It does not phone home to any server. It just displays your content in a carousel.
Main Features
- Fully Responsive: Configure different slide counts for desktop (default 5), tablet (default 3), and mobile (default 1)
- Touch Support: Swipe with mouse or finger on touch devices
- Auto-Play: Automatic sliding with configurable interval (3000ms default)
- Infinite Loop: Continuous sliding without end
- Custom Post Types: Display posts from any public post type (posts, pages, products, portfolios, etc.)
- Complete Styling Control: Change colors, fonts, button styles, and image borders from the admin panel
- Show/Hide Content: Independently control whether to show excerpts, author names, and read more buttons
- Hide Navigation: Option to hide arrows and pagination dots for a cleaner look
- Modern Design: Images have rounded corners on top-left and bottom-right. The card has no background or border – clean and modern.
- Smooth Hover Effects: Images zoom slightly when you hover over them
How To Install SW87 Carousel
- Download the plugin using the link at the bottom of this article
- Go to Plugins → Add New → Upload Plugin
- Install and activate the plugin
- You will see a new menu item called “SW87 Carousel” in your left sidebar. Click it to adjust default settings like colors, font sizes, and how many slides to show.
- Use the shortcode
[sw87_carousel]on any page, post, or widget area.
Basic Shortcode Examples
Display your latest blog posts as a carousel:
[sw87_carousel post_type="post"]
Display 3 slides on desktop, 2 on tablet, 1 on mobile:
[sw87_carousel slides_to_show="3" slides_to_show_tablet="2" slides_to_show_mobile="1"]
Turn off autoplay (so users have to click the arrows):
[sw87_carousel autoplay="false"]
Show the author name, excerpt, and a read more button:
[sw87_carousel show_author="true" show_content="true" show_read_more="true"]
Display posts from a custom post type (like “products” or “portfolio”):
[sw87_carousel post_type="products" limit="12"]
Hide the navigation arrows and dots for a cleaner look:
[sw87_carousel hide_arrows="true" hide_dots="true"]
Complete Shortcode Reference
Query Settings:
post_type– what type of content to show (post, page, or any custom post type) – default: postlimit– how many items to show (-1 means all) – default: -1order– DESC (newest first) or ASC (oldest first) – default: DESCorderby– date, title, modified, or rand (random) – default: date
Display Settings:
slides_to_show– how many slides on a desktop computer (1-10) – default: 5slides_to_show_tablet– how many slides on a tablet (1-10) – default: 3slides_to_show_mobile– how many slides on a phone (1-5) – default: 1autoplay– true (moves automatically) or false – default: trueautoplay_interval– milliseconds between slides (3000 = 3 seconds) – default: 3000loop– true (never ends) or false – default: truegap– space between slides in pixels – default: 20
Content Settings:
show_content– true (shows excerpt) or false – default: falseshow_author– true or false – default: falseshow_read_more– true or false – default: false
Visibility Settings:
hide_arrows– true or false – default: falsehide_dots– true or false – default: false
All of these settings can also be configured in the admin panel under “SW87 Carousel” so you don’t have to type them every time.
Step-by-Step Cleanup (For Non-Technical Users)
Follow these steps in order. Do not skip ahead.
Step 1: Run The Scanner
Install and run the SW87 Security Scanner. Write down the names of any red (critical) plugins it finds.
Step 2: Click “Full Scan” For Each Dangerous Plugin
For every red plugin, click the “Full Scan” button. Wait for it to finish. It will show you every page, post, widget, and theme file that uses that plugin. Write down the locations.
Step 3: Install The Replacement
Install and activate SW87 Carousel (or another safe replacement for non-carousel plugins).
Step 4: Replace The Shortcodes One By One
For each page or post the scanner found, open that page, delete the old shortcode, add your new shortcode (like [sw87_carousel post_type="post"]), and save.
For widgets, go to Appearance → Widgets, find the widget area, replace the shortcode, and save.
For Customizer settings, go to Appearance → Customize, find the section (the scanner tells you which one), remove the old shortcode, add the new one, and click Publish.
Step 5: Test Everything
Visit your website. Click through every page that had a slider. Check on your phone too.
Step 6: Delete The Dangerous Plugin
Only do this after you have replaced every single shortcode. Go to Plugins → Installed Plugins, find the dangerous plugin, click Deactivate, then click Delete.
Step 7: Run The Scanner Again
Run the SW87 Security Scanner one more time to confirm all critical issues are gone.
Step 8: Change Your Passwords
Change your WordPress password, your hosting account password, and your database password (your hosting company can help with the last one).
What About Other Types Of Plugins?
SW87 Carousel only replaces slider and carousel plugins. If the scanner finds a different type of dangerous plugin, here are safe alternatives:
- Popups (instead of Popup Anything on Click): Install “Popup Maker”
- Countdown Timers (instead of Countdown Timer Ultimate): Install “Countdown Builder” or “Everest Countdown”
- Team Members (instead of WP Team Showcase): Install “Team Members” by Webcreations907
- Testimonials (instead of WP Testimonial with Widget): Install “Strong Testimonials”
- Post Grids (instead of Post Grid and Filter Ultimate): Install “PostX” or “Ultimate Post Kit”
- WooCommerce Product Sliders: Install “Products Slider for WooCommerce” by VillaTheme
Frequently Asked Questions
Q: I am not a computer person. Can I just ignore this?
A: Please do not ignore it. Hackers are actively breaking into sites with these plugins. The cleanup above takes about an hour for a typical small business site.
Q: Will the scanner break my site?
A: No. The scanner only reads information. It does not change anything. You cannot break your site by installing or running the scanner.
Q: Do I have to pay for SW87 Carousel?
A: No. Both plugins are completely free. No premium version. No upsells. No hidden tracking.
Q: I deleted the dangerous plugin but now my site has text like [recent_post_carousel] on it. Help!
A: Install SW87 Carousel, edit the page, delete the old shortcode text, add [sw87_carousel], and save.
Q: How long does the full scan take?
A: Usually 10-30 seconds. Larger sites might take 1-2 minutes.
Q: Can I use SW87 Carousel multiple times on the same page?
A: Yes. You can add as many carousels as you want. Each one works independently.
Q: Will SW87 Carousel slow down my website?
A: No. The plugin only loads its code when a carousel is actually on the page. It is lightweight and fast.
Q: I am still nervous. Can I hire someone to do this for me?
A: Yes. Show this guide to any WordPress developer. Expect 1-2 hours of work for a typical site cleanup.
Update: The SW87 Security Scanner was updated to version 3.8 with full database options scanning (finds shortcodes hidden in Customizer settings) and improved theme file scanning. SW87 Carousel version 1.2 adds custom post type support, enhanced styling options including image border customization, and better mobile responsiveness. Both plugins are actively maintained and will be updated as new threats are discovered.
What To Do Right Now
This whole situation is frustrating. You installed a plugin because you trusted it. You did nothing wrong. The betrayal came from the person who bought that plugin company and secretly turned it into a weapon.
But here is the good news: You can fix this. You do not need to be a tech expert. The two plugins below do the hard work for you.
Take a deep breath. Set aside an hour. Work through the steps one by one. You can do this.
Your website is worth protecting. Let’s get it cleaned up today.
SW87 Security Scanner
Version: 3.8SW87 Carousel
Version: 1.2