A Supply-Chain Hack Creates Rogue Admin Accounts in WordPress Sites
A sophisticated threat actor has compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers. The result is the creation of rogue admin accounts on impacted sites, allowing attackers to execute malicious code without detection.
The affected BdThemes plugins are used by over 350,000 active installations on WordPress.org, with its flagship free Element Pack plugin alone boasting more than 100,000 active installs. These plugins include popular tools like Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed them pending a full review.
Researchers from Defiant, a WordPress security firm, discovered the attacks on August 7 through their Wordfence web application firewall (WAF). They found that the attacker “poisoned a static remote JSON data stream fetched by an administrative promotional banner component” after obtaining write access to the vendor’s storage bucket. The researchers attributed this ability to a cross-site scripting (XSS) vulnerability in the JSON response-parsing code, which was introduced in March 2026.
The XSS flaw is found in the Biggop Library used by the Biggopti component responsible for getting promotional banners from the vendor’s API server and showing them in the customers’ WordPress admin dashboard. The malicious JavaScript injection uses the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites, while an additional payload establishes persistence via a webshell.
The attack is entirely API-driven, requiring no interaction, file modification, or plugin update, making it stealthy and difficult to detect. The injected code manipulates WordPress database queries to hide rogue administrator accounts from the user list, making the compromise more challenging to spot.
Defiant’s researchers suspect that the same attacker behind recent supply-chain compromises in Advanced Responsive Video Embedder and OptinMonster may be involved. They analyzed available records and determined that the earliest possible start of the campaign was June 23. The affected plugins were pulled from the WordPress.org directory on August 8, pending investigation.
The vendor has not published an official statement about the incident on its website, and BleepingComputer’s attempts to reach BdThemes for a statement have been met with silence.
This incident highlights the importance of monitoring all layers of your environment before attackers do. A breach and attack simulation can test your SIEM and EDR rules, ensuring that threats don’t slip through detection.
Source: Bleeping Computer — 2026-08-10