A Devastating Supply-Chain Hack Hits WordPress Admins through BdThemes Plugins
A sophisticated threat actor has exploited a vulnerability in the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, to create rogue admin accounts on thousands of websites. The attack, which was first detected by WordPress security firm Defiant on August 7, has left many site owners scrambling to secure their platforms.
BdThemes provides a range of popular plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit, with over 350,000 active installations across the web. The company’s flagship free Element Pack plugin alone boasts more than 100,000 active installations on WordPress.org. Unfortunately, these numbers make it a prime target for attackers looking to spread malware.
The attack works by “poisoning” a static remote JSON data stream fetched by an administrative promotional banner component. This is achieved through a cross-site scripting (XSS) vulnerability in the Biggop Library used by the Biggopti component responsible for getting promotional banners from the vendor’s API server and showing them in customers’ WordPress admin dashboards.
In March 2026, BdThemes introduced a coding flaw in the JSON response-parsing code that created an XSS vulnerability in their infrastructure. This allowed attackers to replace the legitimate promotional JSON with malicious code that exploited this security issue. The malicious JavaScript injection uses the authenticated session of a legitimate administrator’s account to create rogue admin accounts on impacted sites.
The attack is entirely API-driven, requiring no interaction, file modification, or plugin update, making it stealthy and difficult to detect. The injected code manipulates WordPress database queries to hide rogue administrator accounts from the user list, making it even harder for site owners to spot the compromise.
Defiant’s Wordfence researchers have linked this attack to a larger campaign that started as early as June 23. They also believe that the command-and-control (C2) infrastructure used in these attacks points to the same attacker behind recent supply-chain compromises involving Advanced Responsive Video Embedder and OptinMonster plugins.
The affected plugins were pulled from the WordPress.org directory on August 8, pending investigation, while two poisoned API endpoints now return clean JSON data. However, it remains unclear when or if BdThemes will issue an official statement about this incident.
Site owners must take immediate action to protect their platforms. This attack highlights the importance of regularly testing and reviewing third-party plugins and services for vulnerabilities. It also underscores the need for robust security measures, including web application firewalls (WAFs), to prevent API-driven attacks like this one from going undetected.
Source: Bleeping Computer — 2026-08-10