Researchers have raised alarms about a new form of supply chain compromise that targets WordPress sites through a plugin vendor’s content pipeline. The incident centers on the BdThemes supply chain attack, where attackers reportedly poisoned a remote JSON feed used by components inside BdThemes plugins—leading to rogue WordPress administrator accounts and additional malware behavior.
What makes this case stand out is that it did not rely on changing source code files inside the official WordPress.org repository. Instead, the threat was delivered through a static JSON data stream that is pulled and rendered in the WordPress admin area.
What researchers say happened
According to Wordfence researcher Paolo Tresso, the attack did not involve direct modifications of code within the WordPress.org repository. Rather, threat actors reportedly tampered with a remote JSON response that a promotional banner component fetches and displays inside the admin dashboard.
Because the affected data is loaded from a remote API during admin page rendering, the injected content can execute in the browser of a logged-in administrator. This means the malicious behavior can trigger silently, without any user noticing changes to the files installed on the server.
Why the plugins were temporarily disabled
After the issue was identified, the plugin team for the CMS platform disabled plugin downloads temporarily. Visitors to the affected plugin listings on the WordPress plugins directory were shown closure messages around August 7 or 8, 2026, pending a full review.
That pause in availability reflects the real-world impact of a supply chain problem: even if attackers do not alter code in the repository, the runtime delivery mechanism can still compromise sites that already installed the affected plugins.
Affected BdThemes plugins
Researchers shared a list of plugins linked to the incident. The report indicates these plugins had active instances and were impacted by the poisoned JSON pathway through an internal component named Biggopti.
- Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons (bdthemes-element-pack-lite) — 100,000+ active installs
- Live Copy Paste for Elementor — Cross Domain Copy Paste & Page Duplicator (live-copy-paste) — 6,000+ active installs
- Pixel Gallery Addons for Elementor — Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery (pixel-gallery) — N/A
- Prime Slider Addons for Elementor — Widgets, Templates & Elementor Addons (bdthemes-prime-slider-lite) — N/A
- Smart Admin Assistant — Dashboard and Site Enhancements (smart-admin-assistant) — N/A
- Ultimate Post Kit Addons for Elementor (ultimate-post-kit) — N/A
- Ultimate Store Kit — Addon For WooCommerce, EDD and Elementor (ultimate-store-kit) — 6,000+ active installs
The vulnerable mechanism: Biggopti and poisoned JSON
Investigators describe Biggopti as an internal component shipped with the plugins. Its job is to pull promotional banners from an API server and render them in the WordPress admin dashboard by fetching relevant JSON files from a DigitalOcean Spaces bucket.
The vulnerable point is linked to how the JSON response is parsed and displayed. Researchers found a cross-site scripting (XSS) flaw in the JSON parsing logic, tied to the handling of a JSON parameter named display_id. The issue reportedly stems from insufficient client-side escaping.
In practical terms, if an attacker can compromise the API responses, they can inject arbitrary scripts. Those scripts then execute whenever affected admin pages load, which enables attackers to perform follow-on actions in the context of a logged-in administrator.
Medium severity XSS with high impact
The reported XSS issue is rated 5.4 on the CVSS scoring system, which indicates medium severity. However, severity alone does not reflect the end-to-end risk when the XSS executes in wp-admin every time.
In this case, researchers report that the injected code could create rogue administrative accounts, upload a web shell plugin, and communicate with attacker-controlled infrastructure. That combination effectively turns a UI injection flaw into a pathway for persistent compromise and remote code execution.
How the attack payload is delivered
The main payload is reportedly delivered to plugins through an api-data-all-records API endpoint. A JavaScript file named w2.js is described as performing several steps.
- Contacts the command-and-control (C2) server at ia-cdn[.]com/fz/c, including the victim site origin as part of the request. If the C2 replies with a status such as “skip” or “done,” execution is aborted.
- Creates a new rogue administrator using the WordPress REST API.
- Downloads a fake plugin ZIP from the C2 server and installs it via the standard WordPress plugin upload process.
- Deploys a PHP web shell (named emer-run.php) from the installed payload.
- Installs persistence modules into the Must-Use plugins directory (mu-plugins), including a “magic-login backdoor” and an anti-analysis/stealth module.
Researchers say the “magic-login backdoor” supports unauthenticated administrative entry via a URL parameter formatted like ?_wplogin=<token>. It is reportedly designed to target the site’s longest-registered administrator.
Additionally, the stealth component reportedly hooks into WordPress database queries to hide rogue user accounts from the administrative user list, while also adjusting how the total user count is displayed to exclude those accounts.
An alternate payload: deterministic credentials
An alternate script, x.js, was also found described as being served from the plugin developer’s infrastructure through a different endpoint: api-data-records.
Instead of relying entirely on attacker-maintained credential lists, this alternate approach reportedly generates deterministic administrative credentials derived from the victim website’s hostname.
Researchers report the username is created as bd_ followed by a 6-character base36 hash. The password is described as starting with Bd@26! followed by the same hash and an additional trailing character “x,” paired with an @wordpress.org email address.
Because the credentials are computed predictably, defenders and incident responders can potentially reproduce the exact values to search for compromised accounts on suspected domains. The report says the credentials then enable a malicious administrator user to be created, and the results are exfiltrated back to the C2 server.
Timeline clues and why this points to an upstream compromise
The report notes that the change used in the attack pathway appears to have first been introduced on March 1, 2026 in bdthemes-prime-slider-lite, before being applied to other plugins later.
Crucially, researchers say the payload did not require plugin file updates on disk. The campaign could be executed purely by manipulating API data returned to the WordPress admin dashboard.
Wordfence also highlights a key indicator: malicious JSON records and the secondary x.js payload were reportedly uploaded directly into the vendor’s own storage bucket. This pattern suggests a serious compromise of the vendor’s cloud storage credentials or internal infrastructure.
Connections to other recent WordPress plugin incidents
Researchers also assess that the C2 server infrastructure is linked to other software supply chain attacks observed in recent months. In those cases, WordPress plugins were backdoored to grant full administrative access to unauthenticated attackers, either through hard-coded tokens or hidden administrator accounts created and deployed when an admin user logged in.
Although each campaign has its own specifics, the shared theme points toward a broader attacker goal: establishing covert administrative persistence and enabling remote code execution across WordPress environments.
Why this matters for site owners and administrators
For WordPress site owners, this incident is a reminder that plugin security is not only about what is inside the ZIP file. If a plugin fetches remote data that is later rendered in the admin area, the security of that data pipeline becomes part of the site’s threat model.
When XSS can run on every wp-admin page load, the blast radius grows quickly—especially if attackers can chain the script execution into account creation and persistence.
As a related development, the report also mentions that WordPress addressed a separate reflected XSS issue that can lead to PHP code execution when a logged-in administrator interacts with an attacker-controlled page. Together, these events underline how quickly browser-level issues can become server-level compromises.
What to do if you use affected plugins
If you run any of the identified BdThemes plugins, treat this as urgent. Begin with an inventory of installed plugins and their versions, and check whether the site can load promotional banner data or other admin-facing API components.
Next, review administrator accounts and recent changes: look for unexpected admin users, suspicious usernames, or newly installed plugins—especially in directories used for persistence such as mu-plugins. Where possible, rotate credentials and verify that web shell indicators are absent.
Finally, apply security updates promptly and follow incident-response best practices. Because the attack can be delivered through poisoned remote JSON rather than altered plugin files, focus on both the local WordPress state and the remote content pathway.
Conclusion
The BdThemes supply chain attack demonstrates how supply chain threats can bypass traditional “check the plugin ZIP” thinking. By poisoning a remote JSON stream and exploiting a parsing-related XSS flaw, attackers reportedly achieved persistent rogue admin access and deployed web shell capabilities—without needing to modify the official repository files.
For administrators, the takeaway is clear: protect the full plugin execution chain, audit admin access continuously, and respond quickly when security advisories point to API-driven risks in the WordPress admin environment.
Source: https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html
