A sophisticated BdThemes supply chain attack has compromised several popular WordPress plugins, exposing website administrators to account takeover, webshell deployment, and long-term persistence mechanisms.
Unlike traditional WordPress compromises that rely on vulnerable plugin files or malicious updates, this campaign exploited trust in a remote promotional API used by multiple BdThemes products. Attackers never modified the plugin source code hosted in the official WordPress repository. Instead, they poisoned a remote JSON data feed used by the plugins to display promotional content inside administrator dashboards.
Researchers at Wordfence were notified of the incident on August 7, 2026. The WordPress Plugins team has since temporarily closed affected plugins while investigations continue.
The attack demonstrates how trusted third-party services can become malware delivery channels even when local plugin files remain unchanged.
Key Details
The incident affected several popular BdThemes products, including:
- Element Pack Addons for Elementor
- Prime Slider Addons for Elementor
- Pixel Gallery Addons for Elementor
- Ultimate Post Kit
- Ultimate Store Kit
- Live Copy Paste
- Smart Admin Assistant
Researchers discovered that all affected plugins relied on a component known as Biggopti, which retrieves promotional banner data from a remotely hosted API and displays it inside WordPress administrator interfaces.
Instead of compromising WordPress.org infrastructure, attackers gained the ability to alter a static JSON feed hosted in a DigitalOcean Spaces bucket protected by Cloudflare. By poisoning the response, they transformed a trusted promotional service into a malware delivery mechanism.
Wordfence tracked the underlying issue as a cross-site scripting vulnerability involving the display_id parameter and assigned it a CVSS score of 5.4.
Technical Analysis
How the Attack Worked
Researchers found that the Biggopti component failed to properly sanitize the display_id value returned by the promotional API before inserting it into an HTML element identifier.
This allowed attackers controlling the API response to inject malicious JavaScript into WordPress administrator sessions. The payload reportedly used an onanimationstart event handler hidden inside the manipulated HTML attribute, triggering code execution almost immediately when an administrator visited any wp-admin page.
Because the code executed within a legitimate administrator session, attackers gained access to powerful WordPress functions without directly exploiting server-side vulnerabilities.
Rogue Administrator Creation
The first-stage script, identified as w2.js, contacted attacker-controlled infrastructure to determine whether a website should be targeted.
If approved, the script leveraged the active administrator’s WordPress nonce to create a new administrator account under attacker control.
This approach is particularly dangerous because the account creation appears to originate from a legitimate authenticated user session.
Webshell Deployment
Following administrator creation, the malware installed a seemingly harmless plugin using names designed to avoid suspicion.
Researchers observed examples such as:
wp-smart-thumbnails
The plugin contained a webshell known as:
emer-run.php
The webshell allowed attackers to execute commands remotely and maintain direct control over compromised websites.
Persistence and Defense Evasion
Magic Login Backdoor
After deploying the webshell, attackers installed malicious Must-Use (MU) plugins.
One persistence component introduced a so-called “magic login” capability that reportedly granted administrator access through a special URL parameter without requiring normal authentication.
Hidden Administrator Accounts
Another persistence mechanism modified WordPress database queries to conceal attacker-created administrator accounts from standard user management interfaces.
Researchers reported that the malware also manipulated administrator counts and user totals, making unauthorized accounts significantly harder to detect during routine reviews.
Predictable Account Generation
A secondary payload known as x.js generated administrator accounts based on the target website’s hostname.
Affected accounts reportedly used:
- Usernames beginning with
bd_ - Six-character hashes
- Email addresses associated with wordpress.org domains
Wordfence noted that this technique allowed attackers to regenerate credentials without maintaining centralized records of compromised sites.
Why This Supply Chain Attack Is Different
Most WordPress supply chain attacks involve compromised updates, backdoored plugin downloads, or altered repository content.
This incident took a completely different approach.
According to Wordfence, no plugin source code files stored in the official WordPress.org repository were modified. Instead, the compromise occurred through a trusted external API response consumed by installed plugins.
This presents several challenges:
File Integrity Checks May Fail
Because local plugin files remain unchanged, traditional file integrity monitoring tools may not identify the compromise.
Administrators Are Targeted Directly
The attack specifically executes within authenticated administrator browser sessions, giving attackers access to privileged site functionality.
Trust Boundaries Are Expanded
The incident highlights how third-party APIs, advertising feeds, telemetry services, update mechanisms, and promotional platforms can become attack vectors even when the primary application remains uncompromised.
Impact and Risks
Organizations operating affected BdThemes plugins face several immediate risks:
WordPress Administrator Takeover
Attackers can create unauthorized administrator accounts using existing authenticated sessions.
Remote Command Execution
The deployment of the emer-run.php webshell may enable attackers to execute commands directly on affected websites.
Long-Term Persistence
Malicious Must-Use plugins can maintain access even after visible malware components are removed.
Hidden Access Channels
The use of concealed administrator accounts and authentication bypasses increases the likelihood that compromises remain undetected.
Ongoing Site Control
Attackers may retain administrative capabilities even if one persistence mechanism is removed, making comprehensive remediation essential.
Expert Recommendations
Site administrators who operated any affected BdThemes plugin should conduct immediate investigations.
Review Administrator Accounts
Inspect all administrator users and look for suspicious accounts, particularly usernames beginning with:
bd_Show
Search for Malicious Plugins
Investigate installed plugins and verify whether unexpected plugins such as
wp-smart-thumbnails
Check for Webshells
Search for files including:
Plain Text
emer-run.php
and other unauthorized PHP files.
Review Must-Use Plugins
Inspect the WordPress Must-Use plugin directory for unknown or recently added components.
Examine Database Indicators
Review database records for:
fz_emer_login_tokens
and other unusual entries associated with persistence.
Rotate Credentials
Administrators should consider rotating WordPress, hosting, database, and API credentials associated with potentially affected environments.
Industry Context
The BdThemes incident reflects a growing trend in web application attacks: compromising trusted infrastructure rather than modifying application code.
Security researchers increasingly observe attackers targeting:
- Update services
- Content delivery mechanisms
- Third-party APIs
- Analytics integrations
- Promotional feeds
- External configuration systems
Because these components often operate outside traditional file integrity monitoring workflows, they create attractive targets for supply chain operators.
The attack also serves as a reminder that modern application security extends beyond software packages themselves. Any trusted external service capable of influencing application behavior may become a potential supply chain weak point.
Conclusion
The BdThemes supply chain compromise stands out because attackers never altered plugin source code stored within the WordPress ecosystem.
Instead, they weaponized a trusted promotional API to deliver malicious JavaScript directly into administrator sessions, enabling account creation, webshell deployment, and persistent backdoor installation.
For WordPress administrators, the incident reinforces a critical lesson: trusted software can still become dangerous when trusted external services are compromised. Organizations running affected BdThemes plugins should immediately investigate administrator accounts, plugin directories, persistence mechanisms, and webshell indicators to determine whether their environments were impacted.
FAQ SECTION
What is the BdThemes supply chain attack?
It is a WordPress supply chain compromise that abused a poisoned promotional API feed used by multiple BdThemes plugins to deliver malicious JavaScript into administrator sessions.
Were WordPress plugin files modified?
No. Researchers reported that no source code files in the official WordPress.org repository were altered. The attack occurred through a compromised external JSON feed.
What plugins were affected?
Affected plugins include Element Pack Addons, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant.
What malware was installed?
Researchers identified rogue administrator accounts, a fake plugin containing the emer-run.php webshell, and malicious Must-Use plugins designed for persistence.
What should site owners do immediately?
Administrators should review user accounts, inspect plugins and MU-plugins, search for emer-run.php, investigate suspicious database entries, and verify no attacker-created administrator accounts remain
