WordPress Supply Chain Attack Exploits BdThemes Plugins to Create Rogue Admin Accounts and Install Webshells

A supply chain compromise affecting multiple BdThemes WordPress plugins has allowed attackers to hijack administrator sessions, create unauthorized admin accounts, and deploy persistent web shells, without modifying the plugin source code or requiring a plugin update.

Wordfence Threat Intelligence reported being notified of the incident on August 7, 2026. The affected plugins, distributed through the official WordPress.org repository, were temporarily taken offline while the WordPress Plugins team conducts an investigation.

The incident appears to stem from poisoned remote JSON content served through BdThemes’ promotional banner infrastructure rather than malicious code added to the plugin repositories.

WordPress Supply Chain Attack Exploits BdThemes Plugins

BdThemes plugins utilize an internal component called Biggopti to retrieve promotional banners from a remote API endpoint and display them within WordPress administration pages. This API relies on static JSON files hosted in a DigitalOcean Spaces bucket protected by Cloudflare.

Researchers discovered that Biggopti directly inserts the remotely supplied `display_id` value into an HTML `id` attribute without adequate escaping. While another attribute in the same code path applies HTML escaping, the `id` value remains vulnerable to attribute injection.

Attackers reportedly gained write access to the vendor’s object storage content and replaced legitimate JSON responses with malicious values.

A modified `display_id` closes the HTML attribute and adds an `onanimationstart` event handler. Consequently, the injected CSS animation executes silently whenever an authenticated administrator loads a wp-admin page.

This flaw, tracked by Wordfence as a medium-severity cross-site scripting (XSS) issue with a CVSS score of 5.4, was reportedly introduced in Prime Slider version 4.1.9 on March 1, 2026, before appearing in other BdThemes products.

The primary payload, `w2.js`, uses the victim administrator’s authenticated browser session to communicate with `ia-cdn[.]com`. It assesses whether the target should be processed and attempts to create a new administrator account through the WordPress REST API or the standard user-creation workflow.

The payload also downloads and installs a fake plugin, often using benign-sounding names like `wp-smart-thumbnails`. This plugin contains the `emer-run.php` web shell, which attackers can invoke directly to maintain further persistence.

Researchers observed additional Must-Use plugin backdoors placed in the `mu-plugins` directory. One backdoor enables magic-link administrative access using a `_wplogin` URL parameter, while another hides malicious accounts by altering database query results and user totals. The malware allegedly backdates files to September 2025, complicating timeline analysis.

A secondary payload, `x.js`, generates predictable administrator credentials based on the victim site’s hostname. It creates usernames following the pattern `bd_` plus a six-character base36-derived value, with passwords formatted as `Bd@26!<hash>x`. This predictable method allows adversaries to derive credentials for infected sites without maintaining a centralized victim list.

Administrators should immediately review WordPress user accounts, MU-plugin directories, installed plugins, database options, and outbound traffic for the indicators below.

Sites using the affected BdThemes plugins should remove or disable those components until the vendor and WordPress.org provide guidance on remediation.

Since the attack executes through a trusted remote API response, conventional file integrity controls may not detect the initial compromise.

Therefore, it is crucial to monitor for administrative account creations, outbound JavaScript fetches, plugin installation events, and unexpected mu-plugins files.

Indicators of Compromise

Category	Indicator
Affected plugins	bdthemes-element-pack-lite, bdthemes-prime-slider-lite, pixel-gallery, ultimate-post-kit, ultimate-store-kit, live-copy-paste, smart-admin-assistant
Primary payload	ia-cdn[.]com/fz/w2.js
C2 beacon endpoint	ia-cdn[.]com/fz/c
Poisoned API	api[.]sigmative[.]io/prod/store/api/biggopti/api-data-all-records
Poisoned API	api[.]sigmative[.]io/prod/store/api/biggopti/api-data-records
Secondary payload	api[.]sigmative[.]io/prod/store/api/biggopti/x.js
Webshell	emer-run.php – MD5: 1024732009983dd5e54b4cf5593f04d4
MU-plugin backdoor	class-wp-token-validate.php -MD5: 7719cd98a35ffad2771f26d1ceab7d27
MU-plugin stealth module	class-wp-query-*.php – MD5: 9aadc3e5c5242b273bd17c5bdc358845
Additional MU-plugin	wp-cache-optimizer.php – MD5: e450ae5bc4bfc0d960dded06a76bb8e9
Database options	fz_emer_login_tokens, fz_emer_done_v1
Suspicious accounts	bd_ followed by six alphanumeric characters; email domains @wordpress.org or @developer.wordpress.org

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world