WordPress plugin supply chain attack closes BdThemes add-ons

A WordPress plugin supply chain attack has led the WordPress plugins team to temporarily disable downloads for seven add-ons built by the vendor BdThemes, after researchers at the security firm Wordfence found that attackers had poisoned a remote data feed those plugins load into the WordPress admin dashboard. Visitors to each plugin's listing in the official WordPress plugins directory now see a notice saying it was closed on either August 7 or August 8, 2026, and is not available for download pending a full review.

Wordfence researcher Paolo Tresso said the campaign differs from the kind of supply chain compromise site owners are used to, because no source code file inside the WordPress.org repository was modified at all. Instead, the attackers poisoned a static JSON data stream that an administrative promotional banner component fetches from a remote server. JSON is a simple text format that software uses to exchange data, and because these plugins read that text from someone else's server rather than carrying it inside their own code, changing the text changes what the plugin does without touching the plugin.

The plugins named by Wordfence are Element Pack Addons for Elementor (bdthemes-element-pack-lite), which the listing shows with more than 100,000 active installations; Live Copy Paste for Elementor (live-copy-paste) and Ultimate Store Kit, an add-on for WooCommerce, EDD and Elementor (ultimate-store-kit), both with more than 6,000 active installations; and Pixel Gallery Addons for Elementor (pixel-gallery), Prime Slider Addons for Elementor (bdthemes-prime-slider-lite), Smart Admin Assistant (smart-admin-assistant) and Ultimate Post Kit Addons for Elementor (ultimate-post-kit), for which no installation figures were given.

According to Wordfence, the problem sits in an internal component called Biggopti that ships alongside the plugins. It is designed to pull promotional banners from the vendor's API server and render them in the WordPress admin dashboard by fetching JSON files from a DigitalOcean Spaces bucket, a cloud storage service. The library is vulnerable to a cross-site scripting (XSS) flaw in the code that parses the JSON response, reachable through the display_id parameter of the Sigmative API and caused by insufficient client-side escaping. Cross-site scripting means an attacker can place their own code inside a page a victim loads, so that code runs in the victim's browser with that page's privileges. Here, an attacker who can compromise the API can inject scripts into pages that execute every time someone opens them. Because the component runs on every wp-admin page load, the injected code activates silently in the browser of any logged-in administrator. The flaw is rated 5.4 on the CVSS scoring system, which places it in the medium severity range.

Wordfence says the change was first introduced on March 1, 2026, in bdthemes-prime-slider-lite before being applied to the other plugins, and that the entire attack is driven through the API: it needs no plugin update and no file changed on disk.

Wordfence said rogue actors obtained write access to the DigitalOcean Spaces bucket and replaced the legitimate JSON responses with crafted payloads. From there, the injected script creates rogue administrator accounts, uploads a web shell plugin and phones home to a command-and-control (C2) server, meaning a machine the attackers control that hands out instructions and receives stolen data. A web shell is a small script planted on a server that lets an attacker run their own commands on it from a distance.

The main payload reaches the plugins through an API endpoint called api-data-all-records. A JavaScript file named w2.js then does the following, according to Wordfence: it contacts the C2 server at ia-cdn[.]com/fz/c, sending the victim website's origin to fetch targeting instructions, and aborts if that server replies with a skip or done status; it creates a new rogue administrator through the WordPress REST API; it downloads a fake plugin ZIP from the C2 server and installs it through the standard plugin upload form, which deploys a PHP web shell named emer-run.php; and it calls that web shell to place two persistence modules in the must-use plugins (mu-plugins) directory. Must-use plugins are loaded automatically by WordPress and are harder to remove than ordinary ones. The first module is a magic-login backdoor that allows unauthenticated administrative entry through a URL parameter (?_wplogin=) and targets the site's longest-registered administrator. The second is an anti-analysis stealth module that hooks into WordPress database queries so the rogue accounts are hidden from the administrative user list and the displayed user count leaves them out.

A second payload, a file called x.js that was found hosted on the plugin developer's infrastructure, is served to victims through an endpoint named api-data-records. It is built to generate what Wordfence calls deterministic administrator credentials, derived mathematically from the victim website's hostname. Deterministic means the same starting information always produces the same result, so nobody needs to keep a list of compromised sites in order to know the login details. Wordfence said the algorithm produces predictable usernames, bd_ followed by a six-character base36 hash, and passwords, Bd@26! followed by the hash and an x, paired with an @wordpress.org email address. The researcher noted that because the credentials can be recalculated, incident responders can work out the exact username and password to hunt for on suspected domains instead of relying on a stolen list. Those credentials are used to create a malicious administrator account, and the results of the attack are sent back to the C2 server.

Wordfence assesses that the C2 server is related to two other software supply chain attacks in recent months, one involving Advanced Responsive Video Embedder (CVE-2026-18072) and one involving OptinMonster. In both of those cases the plugins were backdoored to give unauthenticated attackers full administrative access, either through a single hard-coded token or through a hidden administrator account and a concealed plugin that were created and installed only when a site administrator logged in. Wordfence reads the pattern as pointing to a single goal: covert administrative persistence and remote code execution across WordPress environments.

The fact that malicious JSON records and the secondary x.js payload were uploaded straight into the vendor's own bucket, Wordfence said, indicates a severe upstream compromise of BdThemes' cloud storage credentials or internal infrastructure.

The disclosure also lands days after WordPress addressed a pre-authentication reflected XSS flaw tracked as CVE-2026-64638, also known as XSS2Shell, with a CVSS score of 8.9. That flaw can be exploited to achieve PHP code execution on the server when a logged-in administrator interacts with a page an attacker controls