A supply-chain attack involving seven BdThemes WordPress plugins has allowed attackers to create hidden administrator accounts and install webshells on affected websites. The campaign reportedly abused a poisoned remote promotional feed rather than altered plugin files, making the compromise difficult to spot through routine plugin checks alone.
Key takeaways
The incident matters because it targeted trusted administrator sessions and could leave persistent access behind.
- Seven BdThemes plugins were temporarily removed from the WordPress.org directory.
- Attackers poisoned a remote JSON feed used by the plugins’ admin-dashboard banners.
- The payload could create rogue administrators and install a webshell without changing plugin files.
- Evidence of the campaign may date back to June 23, 2026.
- Website owners should investigate even if the affected feed is now clean.
How the attack worked
The affected plugins used an internal component called Biggopti to retrieve promotional banners from BdThemes infrastructure and display them inside the WordPress dashboard. A coding flaw failed to properly escape the display_id value received in the remote JSON response, creating a cross-site scripting opportunity.
After gaining access to the vendor’s storage bucket, attackers replaced legitimate banner data with JavaScript. When a logged-in administrator opened a wp-admin page, the script could run within that authenticated session and use the administrator’s WordPress security token to create another administrator account.
This approach meant the plugin files hosted on WordPress.org did not need to be modified. It also meant that simply checking file integrity or reinstalling a plugin might not reveal the full extent of the compromise.
Plugins and persistence methods involved
Reports identify the affected products as Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste and Smart Admin Assistant. Element Pack alone has more than 100,000 active installations listed on WordPress.org.
The attack chain reportedly uploaded a disguised plugin containing a webshell named emer-run.php. Additional Must-Use plugins could then provide persistence, including a hidden login route and code designed to conceal rogue accounts from normal WordPress user screens. Some accounts reportedly used bd_-prefixed usernames and predictable credentials derived from a site’s hostname.
What website owners should do
The promotional endpoints were reportedly cleaned on August 8, but cleaning the source does not remove accounts or backdoors already installed on a website. Owners should treat any site that used an affected plugin during the exposure period as potentially compromised.
A practical review should include:
- Checking all administrator accounts, including recently created users and unfamiliar email addresses.
- Inspecting normal plugins and the
mu-pluginsdirectory for unexpected files. - Searching for
emer-run.php, suspiciousclass-wp-query-*files and thefz_emer_login_tokensdatabase option. - Reviewing logs for connections to
ia-cdn[.]com, user creation and plugin uploads. - Changing passwords, refreshing WordPress salts and removing unauthorised access only after preserving evidence.
Why a WordPress care plan helps
This incident shows why WordPress maintenance involves more than installing updates. A dependable WordPress maintenance plan should include regular security scans, administrator-account reviews, monitoring for unexpected plugin changes and reliable backups that can support a clean recovery.
If your site uses BdThemes products, consider isolating it and arranging a professional investigation before assuming that deleting or updating the plugin has solved the problem. Ongoing monitoring through a WordPress care plan can also help identify hidden users, suspicious files and unusual activity before an attacker turns a trusted plugin into a full site takeover.
Sources
- WordPress Plugins Compromised Without a Single File Change, Infosecurity Magazine.
- BdThemes plugins supply-chain hack creates rogue WordPress admins, BleepingComputer.
- BDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys Webshells, Cyber Press.
- New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response, CyberSecurityNews.
- BdThemes Plugins: Critical Attack on WordPress, SecNews.gr.