BdThemes plugins supply-chain hack creates rogue WordPress admins
This digest was compiled by AI from multiple sources — links to the originals are below.
A threat actor compromised BdThemes' upstream infrastructure and poisoned a JSON feed to inject rogue admin accounts into WordPress sites. The attack, detected by Wordfence on August 7, affected plugins with over 350,000 active installations, including Element Pack. The WordPress Plugins team closed all affected products pending review.
Supply Chain Compromise
On August 7, Defiant’s Wordfence detected attacks targeting BdThemes’ premium WordPress plugins, which include Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. The attacker obtained write access to the vendor’s storage bucket and modified a static remote JSON data stream delivered to administrators’ browsers. BdThemes’ flagship free Element Pack plugin has more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio exceeding 350,000 active installs. The WordPress Plugins team subsequently closed all affected products on Saturday, pending a full review.
Attack Mechanism
The attack exploited a cross-site scripting (XSS) vulnerability in the Biggop Library, used by the Biggopti component to fetch promotional banners from the vendor’s Sigmative API server. Researchers found the flaw was introduced in March 2026 due to insufficient output escaping on the ‘display_id’ parameter. When a logged‑in administrator opened a wp‑admin page, the malicious JavaScript executed automatically, leveraging the authenticated session to create hidden rogue admin accounts. Wordfence assigned the vulnerability a medium severity score and reported it as unpatched at the time of disclosure.
Persistence and Stealth
An additional payload established persistence by installing a webshell (emer-run.php) and a fake plugin, ensuring continued access even if the rogue accounts were removed. The injected code manipulated WordPress database queries to hide the unauthorized administrators from the user list, making detection difficult. The attack is entirely API‑driven and requires no file modification or plugin update, leaving no visible traces on the server. BleepingComputer confirmed the payload executes on every admin page load, keeping the compromise stealthy.
What's Next
BdThemes has not yet commented or released a patch, and the WordPress Plugins team continues its review. The full number of compromised sites remains unclear, and administrators are advised to check for unauthorized users and monitor for webshells until a definitive fix is available.
2 sources
BdThemes plugins supply-chain hack creates rogue WordPress admins
