On September 14, 2026, attackers who stole a Cloudflare API key from the email marketing platform Brevo used it to push malicious code through Brevo’s own websites and the scripts its customers embed - for about five and a half hours. If your site embeds Brevo forms or widgets, especially on WordPress, you should check it for a hidden plugin installed that day.
Quick answer: According to BleepingComputer, attackers stole a Cloudflare API key hardcoded in Brevo’s source code and used it to inject malicious scripts into Brevo’s sites and customer-embedded components on September 14, 2026. Visitors saw fake “verification” pages designed to install malware, and on WordPress sites the script tried to plant a hidden backdoor plugin. If anyone administered your WordPress site while logged in that day, check for plugins installed or activated on September 14, remove anything unfamiliar, and rotate admin passwords.
What happened?
Brevo - the email marketing and CRM platform formerly known as Sendinblue - confirmed the incident in a public post-mortem on September 17. Attackers obtained a long-lived Cloudflare API key that was hardcoded in Brevo’s application source code, with full account permissions. With it, they created a malicious Cloudflare Worker - a script that runs at Cloudflare’s edge, between a visitor and the website - without triggering Brevo’s internal alerts.
For about five and a half hours on September 14 (Brevo defines the window as 16:07 to 20:30 UTC), that Worker rewrote content on brevo.com, sendinblue.com, and related domains, and modified three scripts that customers embed on their own websites: the Brevo forms script, the Brevo Conversations widget, and the Brevo SDK loader. Security firm Sansec, which first reported the incident, estimated that up to 100,000 websites use the affected components.
Visitors to affected pages saw a fake Cloudflare verification page followed by “ClickFix” instructions - a scam pattern that tells people to press Windows+R, paste a command, and run it, which installs malware instead of fixing anything.
The most serious part targeted WordPress. On WordPress sites embedding an affected Brevo widget, the script checked whether the visitor was logged in as an administrator and, if so, tried to upload a file disguised as a plugin named “Web Media Optimizer.” BleepingComputer analyzed the file and confirmed it is a persistent backdoor: it hides itself from the WordPress plugin list, copies itself into the must-use plugins directory so it survives ordinary cleanup, periodically fetches additional malicious JavaScript, and contains a hardcoded key that lets the attackers generate a valid administrator session without ever knowing the password.
Brevo has since revoked the key, removed the Worker, and purged its edge caches. Sansec confirmed the malicious subdomains stopped resolving on September 15 and that Brevo’s files are now clean. Brevo says its app, API, email delivery infrastructure, and customer account data were not affected.
Why does this matter for small businesses?
For Pennsylvania small businesses and nonprofits, three parts of this story matter.
This is the “trusted vendor” problem, and you didn’t do anything wrong. Small organizations embed third-party scripts all the time - newsletter signup forms, chat widgets, booking tools. A Brevo form on your contact page is a reasonable, normal choice. The compromise happened upstream of you, which is exactly what makes supply-chain attacks uncomfortable: your own website can serve malicious code on a day you changed nothing.
The WordPress angle is the part with teeth. The exposure window was one afternoon, but the backdoor plugin persists until someone finds and removes it - and because it hides from the plugin list and carries a hardcoded admin-session key, “we changed all our passwords” is not enough. It has to be found and deleted.
Your email list is probably fine; your website is the thing to check. Brevo says customer account data was not touched in this incident. The action item this week is on the website side, not the email side.
What should you do this week?
-
If your website embeds Brevo forms, the Conversations widget, or the Brevo SDK, confirm the scripts are clean. Sansec says Brevo’s files have been clean since September 15, so sites loading current scripts are fine. If you’re not sure what your site embeds, ask whoever manages it.
-
If you or a colleague were logged into WordPress as an administrator on September 14 on a site with Brevo components, check the plugin list. Look for anything installed or activated that day - especially “Web Media Optimizer” - and also check the must-use plugins directory (
wp-content/mu-plugins) for files you don’t recognize. Remove them, then rotate administrator passwords. -
Brief your team on ClickFix. The rule is simple: no real Cloudflare, Microsoft, or browser verification page asks you to press Windows+R and paste a command. If a webpage tells you to do that, close the tab.
-
Take stock of the third-party scripts on your site generally. Every form, chat widget, and analytics tag is code you trust but don’t control. A short list is easier to audit the next time a vendor has a bad day.
-
If someone else manages your website, ask one direct question. “Were we embedding any Brevo components on September 14, and has anyone checked the WordPress plugin list since?” A good IT partner answers with specifics, not a shrug.
Frequently asked questions
My website uses Brevo forms or widgets. Was my site affected? Only sites loading the affected Brevo scripts during the exposure window on September 14, 2026 (roughly 16:07 to 20:30 UTC) served the malicious content. Security firm Sansec, which first reported the incident, confirmed Brevo’s files have been clean since September 15. The risk that lingers is the WordPress backdoor: if an administrator was logged in while visiting an affected page, a hidden plugin may have been installed. Check your plugin list and your must-use plugins directory.
What is ClickFix? ClickFix is a scam pattern where a fake error or verification page tells you to press Windows+R, paste a command, and run it. The command installs malware instead of fixing anything. No legitimate Cloudflare, Microsoft, or browser verification page will ever ask you to run a command this way - if a website does, close the tab.
Was Brevo customer data, like our email list, stolen? Brevo says no. In its post-incident write-up, the company states that app.brevo.com, its API, its email delivery infrastructure, and customer account data were not affected by this incident. The attack modified scripts served to websites, not the data stored in Brevo accounts.
We don’t use WordPress. Do we still need to do anything? The WordPress backdoor doesn’t apply to you, and Brevo’s scripts are clean now. The main takeaway for any site that embedded Brevo components is staff awareness: visitors during the exposure window could have seen the fake verification page, so make sure your team knows the ClickFix pattern and never runs commands a webpage tells them to paste.
What is the single most important thing to do this week? If you run a WordPress site that embeds Brevo components and anyone was logged in as an administrator on September 14, check for plugins installed or activated that day - especially one named “Web Media Optimizer” - remove anything unfamiliar, and rotate your administrator passwords. If that doesn’t apply to you, brief your team on ClickFix and move on.
Where Merit IT fits in
Attacks like this one don’t break into your systems - they arrive through a vendor you already trusted, which is why keeping the lights on includes watching what your website actually serves, not just what’s on your network. At Merit IT, that kind of attention is part of our IT support practice: patching, monitoring, and checking the unglamorous corners - like a must-use plugins directory - before they become a problem. And when a site we build embeds third-party code, our software development team treats those dependencies as part of the review, because “the vendor’s script did it” is still your website to your visitors.
We work with small businesses and nonprofits across Pennsylvania month-to-month - no long-term contract. We earn your business every single month, or we don’t.
Get a free technology assessment - we’ll review your website’s third-party scripts, your patching status, and your overall security posture, and give you a clear picture of where you stand. No obligation, no pressure. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.