A supply chain attack targeting BdThemes WordPress plugins has exposed site administrators to account takeover, webshell deployment, and persistent backdoors.

Wordfence Threat Intelligence was notified of the incident on August 7, 2026, after discovering that attackers had poisoned a remote promotional API feed used by several popular BdThemes plugins.

The affected plugins include Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant.

The WordPress Plugins team temporarily closed the plugins in the official directory while its investigation continues. The attack is notable because attackers did not modify plugin source code stored in the WordPress.org repository.

Instead, they compromised a static JSON data stream hosted in a DigitalOcean Spaces bucket and protected by Cloudflare.

BdThemes plugins use an internal component named Biggopti to retrieve promotional banners from this remote API and display them in the WordPress admin dashboard.

WordPress Supply Chain Attack

Researchers found that Biggopti failed to safely escape the display_id value from the JSON response before inserting it into an HTML id attribute. This created a cross-site scripting vulnerability tracked by Wordfence with a CVSS score of 5.4.

An attacker who gained write access to the vendor’s storage bucket could replace legitimate banner data with a malicious display_id value.

When a logged-in WordPress administrator opened any wp-admin page, the poisoned response triggered JavaScript in the administrator’s browser.

The payload used an onanimationstart event handler hidden inside the injected HTML attribute, allowing it to run silently within milliseconds.
The malicious script then fetched additional payloads from attacker-controlled infrastructure.

The primary payload, identified as w2.js, first contacted the command-and-control server at ia-cdn[.]com/fz/c to determine whether the victim should be targeted. If approved, it used the active administrator’s WordPress nonce to create a rogue administrator account.

The malware also installed a fake plugin, often using a harmless-looking name such as wp-smart-thumbnails. That plugin contained a webshell called emer-run.php, which attackers could access directly to execute commands remotely.

The webshell then installed malicious Must-Use plugins for persistence. One persistence component created a magic-login backdoor that allowed unauthenticated administrator access through a special URL parameter.

Another manipulated WordPress database queries to hide attacker-created administrator accounts from the normal user list. The malware also altered user totals to make the compromise harder to detect. A secondary payload, x.js, generated predictable administrator credentials from the victim site’s hostname.

These accounts used usernames beginning with bd_ followed by a 6-character hash and often used @wordpress.org email addresses. This design let attackers recreate credentials for compromised websites without maintaining a central victim list.

Wordfence said the campaign may have started as early as June 23, 2026, based on timestamps in poisoned promotional records. Although the compromised API endpoints were cleaned on August 8, administrators should still investigate systems that ran the affected plugins.

Site owners should review WordPress administrator accounts, inspect installed plugins and the Must-Use plugin directory, and search for emer-run.php, suspicious class-wp-query-* files, and the fz_emer_login_tokens database option.

This incident shows how a trusted remote data feed can become an effective malware delivery channel even when local plugin files remain unchanged.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response appeared first on Cyber Security News.