Cybersecurity researchers have identified a supply chain attack targeting BdThemes, a vendor of WordPress plugins. This incident has led the WordPress plugins team to temporarily disable downloads of the affected plugins.
Unlike typical supply chain attacks that involve direct modification of source code, this breach exploited a static remote JSON data stream used by an administrative promotional banner component within the plugins. The compromised plugins include:
- Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] – over 100,000 active installations
- Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste] – over 6,000 active installations
- Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery [pixel-gallery] – installation data not available
- Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons [bdthemes-prime-slider-lite] – installation data not available
- Smart Admin Assistant – Dashboard and Site Enhancements [smart-admin-assistant] – installation data not available
- Ultimate Post Kit Addons for Elementor [ultimate-post-kit] – installation data not available
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit] – over 6,000 active installations
Users visiting the listings for these plugins on the WordPress plugins directory are informed that they have been closed as of August 7 or 8, 2026, pending a comprehensive review.
The root cause of the issue lies in an internal component called Biggopti, included with the plugins. This system fetches promotional banners from BdThemes’ API server and displays them in the WordPress admin dashboard by retrieving JSON files from a DigitalOcean Spaces bucket.
A vulnerability in the JSON response parsing code, specifically in the “display_id” parameter from the Sigmative API, allows for cross-site scripting (XSS) due to inadequate client-side escaping. Consequently, an attacker with access to the API can inject arbitrary scripts into pages, which execute whenever a user accesses those pages.
Since the script runs on every “wp-admin” page load, the injected code activates silently in the browser of any logged-in administrator. This vulnerability has a CVSS score of 5.4, indicating medium severity.
The vulnerability was first introduced on March 1, 2026, in the “bdthemes-prime-slider-lite” plugin before being applied to others. Notably, this attack is entirely API-driven and does not require plugin updates or file modifications on disk.
Attackers gained write access to the DigitalOcean Spaces bucket, replacing legitimate JSON responses with malicious payloads to exploit the vulnerability. The XSS executes within the browser of any logged-in admin on every “wp-admin” page load. The injected script then creates rogue administrator accounts, uploads a web shell plugin, and communicates with a command-and-control (C2) server.
The primary payload is delivered to the plugins via the “api-data-all-records” API endpoint. A JavaScript file named “w2.js” performs the following actions:
- Contacts the C2 server (“ia-cdn[.]com/fz/c”) with the victim website’s origin to fetch targeting instructions. Execution is aborted if the C2 server returns a “skip” or “done” status.
- Creates a new rogue administrator via the WordPress REST API.
- Downloads a fake plugin ZIP from the C2 server and installs it via the standard plugin upload form, leading to the deployment of a web shell.
This incident underscores the evolving nature of supply chain attacks, where adversaries exploit indirect components like APIs to infiltrate systems. Organizations must remain vigilant, ensuring that all components, including third-party APIs and data streams, are secure. Regular audits and monitoring of such components are essential to detect and mitigate potential threats promptly.
