BdThemes Supply-Chain Attack Creates Hidden WordPress Admins

BdThemes, a developer of premium WordPress plugins, has fallen victim to a supply-chain attack. According to Defiant (the company behind the Wordfence firewall), the attacker gained write access to the vendor's cloud storage and swapped out the static JSON feed that the plugins pull in to display advertising banners in the admin panel. As a result, malicious code executed in the browser of every logged-in administrator who opened a wp-admin page.

BdThemes makes products such as Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery and Ultimate Store Kit. The free version of its flagship Element Pack alone is installed on more than 100,000 sites, and the developer's entire portfolio exceeds 350,000 active installations.

How the attack worked

At the heart of the breach is a cross-site scripting (XSS) vulnerability that the developers themselves introduced into the JSON-response parsing code back in March 2026. The flaw sits in the Biggop Library, which is responsible for fetching banners from the vendor's API server: the “display_id” parameter from the API response was insufficiently escaped, allowing arbitrary scripts to be injected. Having seized control of the Sigmative API server, the attacker replaced the legitimate advertising JSON with a malicious one.

The injected JavaScript leverages the administrator's already authenticated session to create new hidden accounts with administrator privileges. An additional payload (w2.js) establishes persistence through a web shell (emer-run.php), installing a fake plugin. To make detection harder, the code manipulates queries to the WordPress database and hides the created accounts from the user list.

What makes it especially dangerous is that the attack is driven entirely through the API: it requires no user interaction, no file changes and no plugin update. The payload executes silently every time the admin panel is opened.

Timeline and impact

Wordfence recorded the first attacks on August 7, but an analysis of the available records showed that the campaign may have begun as early as June 23. The vulnerabilities were assigned a “medium” severity level; there was no patch at the time of publication. The command-and-control (C2) infrastructure used in the attacks points to the same attacker behind the recent supply-chain breaches of Advanced Responsive Video Embedder and OptinMonster.

On August 8, the WordPress.org team pulled the affected plugins from the catalog pending the completion of the investigation, and the two poisoned API endpoints now return clean data. No official statement from BdThemes had been issued at the time of writing.

Source: Bleeping Computer