A recent supply chain attack has compromised several WordPress themes developed by BdThemes, exposing site administrators to risks such as account takeovers, webshell deployments, and persistent backdoors.
On August 7, 2026, Wordfence Threat Intelligence identified that attackers had tampered with a remote promotional API feed utilized by multiple BdThemes plugins. The affected plugins include Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant.
In response, the WordPress Plugins team temporarily removed these plugins from the official directory pending further investigation. Notably, the attackers did not alter the plugin source code within the WordPress.org repository. Instead, they compromised a static JSON data stream hosted in a DigitalOcean Spaces bucket, which was protected by Cloudflare.
The BdThemes plugins employ an internal component named Biggopti to fetch promotional banners from this remote API and display them in the WordPress admin dashboard. Researchers discovered that Biggopti failed to properly escape the display_id value from the JSON response before inserting it into an HTML id attribute. This oversight created a cross-site scripting vulnerability with a CVSS score of 5.4.
By gaining write access to the vendor’s storage bucket, attackers replaced legitimate banner data with a malicious display_id value. Consequently, when a logged-in WordPress administrator accessed any wp-admin page, the poisoned response executed JavaScript in the administrator’s browser. The payload utilized an onanimationstart event handler concealed within the injected HTML attribute, allowing it to run silently within milliseconds.
The malicious script then retrieved additional payloads from attacker-controlled infrastructure. The primary payload, identified as w2.js, first contacted the command-and-control server at ia-cdn[.]com/fz/c to determine whether the victim should be targeted. If approved, it used the active administrator’s WordPress nonce to create a rogue administrator account.
Additionally, the malware installed a fake plugin, often named innocuously like wp-smart-thumbnails. This plugin contained a webshell called emer-run.php, enabling attackers to execute commands remotely. The webshell then installed malicious Must-Use plugins for persistence. One such component created a magic-login backdoor, allowing unauthenticated administrator access through a special URL parameter. Another manipulated WordPress database queries to conceal attacker-created administrator accounts from the standard user list, even altering user totals to evade detection.
A secondary payload, x.js, generated predictable administrator credentials based on the victim site’s hostname. These accounts used usernames beginning with bd_ followed by a six-character hash and often employed @wordpress.org email addresses. This design enabled attackers to recreate credentials for compromised websites without maintaining a central victim list.
Evidence suggests that this campaign may have commenced as early as June 23, 2026, based on timestamps in the poisoned promotional records. Although the compromised API endpoints were cleaned on August 8, administrators are advised to investigate systems that ran the affected plugins. Site owners should review WordPress administrator accounts, inspect installed plugins and the Must-Use plugin directory, and search for emer-run.php, suspicious class-wp-query-* files, and the fz_emer_login_tokens database option.
This incident underscores the potential for trusted remote data feeds to serve as effective malware delivery channels, even when local plugin files remain unchanged. It highlights the critical need for developers and site administrators to implement robust security measures, including regular audits of external data sources and vigilant monitoring for unauthorized changes.
