BdThemes WordPress Plugin Supply Chain Compromise

A supply chain attack against BdThemes WordPress plugins has led the WordPress plugins team to temporarily disable downloads, according to researchers at Wordfence. A supply chain attack is one that compromises a trusted software vendor or its delivery mechanism to reach many downstream users. The company said the attack did not modify any source code files in the official WordPress.org repository. Instead, attackers poisoned a remote JSON data stream that an administrative promotional banner component fetched, allowing malicious code to run inside the WordPress admin area. JSON, short for JavaScript Object Notation, is a plain-text format that websites use to exchange data.

The affected plugins are Element Pack Addons for Elementor (bdthemes-element-pack-lite, 100,000+ active installs), Live Copy Paste for Elementor (live-copy-paste, 6,000+ active installs), Pixel Gallery Addons for Elementor (pixel-gallery), Prime Slider Addons for Elementor (bdthemes-prime-slider-lite), Smart Admin Assistant (smart-admin-assistant), Ultimate Post Kit Addons for Elementor (ultimate-post-kit), and Ultimate Store Kit (ultimate-store-kit, 6,000+ active installs). Visitors to the plugin directory pages for these items see a notice that the plugins were closed on August 7 or 8, 2026, pending a full review. Wordfence researcher Paolo Tresso explained that the weakness sits in an internal component called Biggopti, which is shipped with the plugins to pull promotional banners from the vendor's API server by fetching JSON files from a DigitalOcean Spaces bucket. An API, or application programming interface, is a way for one piece of software to request data from another.

The Biggopti library has a cross-site scripting (XSS) flaw in the way it parses a field called 'display_id' in JSON responses from the Sigmative API. Cross-site scripting is a weakness that lets an attacker run malicious script in a visitor's browser. Because the code does not escape that field safely on the client side, an attacker who can control the API response can inject arbitrary web scripts that run whenever a page is viewed. Since the malicious script executes on every wp-admin page load, any logged-in administrator's browser silently runs it. The wp-admin area is the administration panel of a WordPress site where owners manage content and settings. The vulnerability is rated 5.4 on the CVSS scoring system, a standard scale from 0 to 10 that rates how serious a security flaw is. The vulnerable code was first introduced on March 1, 2026, in the bdthemes-prime-slider-lite plugin and later applied to the others.

Wordfence said rogue actors obtained write access to the DigitalOcean Spaces bucket and replaced legitimate JSON responses with crafted payloads. This allowed the attack to be driven entirely through the API, with no plugin updates or files modified on disk. The main payload, delivered through an API endpoint called api-data-all-records, is a JavaScript file named w2.js. That script first contacts a command-and-control (C2) server at ia-cdn[.]com/fz/c with the victim website's origin and stops if the server returns a skip or done status. A C2 server is a computer that attackers use to send instructions to compromised websites. If it continues, the script uses the WordPress REST API to create a new administrator account. A REST API is a set of rules that lets programs communicate over the web. It then downloads a fake plugin ZIP from the C2 server and installs it through the standard plugin upload form, which deploys a PHP web shell named emer-run.php. A web shell is a hidden script that lets an attacker send commands to the server remotely.

The web shell then installs two persistence modules into the must-use plugins directory, which loads automatically and cannot be turned off from the normal plugin screen. The first module is a magic-login backdoor that allows unauthenticated administrative entry through a URL parameter such as ?_wplogin=, targeting the site's longest-registered administrator. The second module is an anti-analysis stealth component that hooks into WordPress database queries to hide the rogue user accounts from the administrative user list and to display the total user count without them. A second payload, x.js, was found hosted on the plugin developer's own infrastructure and served to victims through an API endpoint called api-data-records. This payload generates deterministic administrator credentials mathematically derived from the victim website's hostname. Wordfence said the algorithm produces predictable usernames in the form bd_ followed by a 6-character base36 hash, and passwords in the form Bd@26! followed by the hash and the letter x, paired with an @wordpress.org email address. A base36 hash is a short code made from letters and numbers. Because the credentials are deterministic, attackers do not need to store a central list of compromised sites, and incident responders can compute the exact username and password to search for on suspected domains.

The WordPress security company assessed that the C2 server used in this campaign is related to two earlier software supply chain attacks involving the Advanced Responsive Video Embedder plugin, tracked as CVE-2026-18072, and OptinMonster. In those cases, the plugins were backdoored to grant full administrative access to unauthenticated attackers, either through a single hard-coded token or through a hidden administrator account and concealed plugin that were created only when a site admin logged in. Wordfence believes the end goal of the campaign is to establish covert administrative persistence and remote code execution across WordPress environments. The fact that the malicious JSON records and the secondary x.js payload were uploaded directly into the vendor's own bucket indicates a severe upstream compromise of BdThemes' cloud storage credentials or internal infrastructure.

The disclosure comes days after WordPress addressed a separate pre-authentication reflected XSS flaw, CVE-2026-64638, also known as XSS2Shell, rated 8.9 on the CVSS scale. Pre-authentication means an attacker does not need an account to trigger the weakness. That flaw could be exploited to achieve PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. For WordPress site owners, a managed WordPress hosting service such as AEU Hosting can reduce exposure by keeping the core platform and plugins updated and by monitoring for known compromise indicators, although no hosting provider can detect a vendor-side supply chain attack like this one before it is publicly disclosed.