WordPress site administrators woke up Saturday to find seven popular plugins missing from the official directory. The plugins had not been hacked in the traditional sense. Nobody modified their source code on WordPress.org. Instead, attackers poisoned a JSON promotional banner feed that the plugins fetched from a third-party server, turning a trusted remote data stream into a silent backdoor. The BdThemes supply chain attack potentially compromised over 350,000 active installations across the developer's portfolio, and the earliest signs of tampering date back to June 23, 2026.
The attack runs without modifying plugin files, without a plugin update, and without any user interaction beyond an admin loading a wp-admin page.
BdThemes is a developer of premium WordPress design plugins including Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant. The flagship free Element Pack plugin alone shows more than 100,000 active installations on WordPress.org, and the developer advertises a portfolio with over 350,000 active installs. On August 7, WordPress security firm Defiant discovered through its Wordfence firewall that a threat actor had poisoned a remote JSON data stream used by an administrative promotional banner component inside these plugins.
How did attackers backdoor plugins without touching plugin code?
The attack targeted a component called Biggopti, which retrieves promotional banners from a remote API endpoint and displays them inside the WordPress admin dashboard. BdThemes plugins fetch this data from static JSON files hosted in a DigitalOcean Spaces bucket protected by Cloudflare. The API endpoints live at api.sigmative.io.
Attackers obtained write access to that storage bucket and replaced legitimate JSON responses with malicious values. The key vulnerability was in how the Biggop Library parsed the display_id field from the JSON response. The library inserted this value directly into an HTML id attribute without adequate escaping. An attacker who controlled the JSON could close the attribute and inject an onanimationstart event handler. When a logged-in WordPress administrator opened any wp-admin page, the injected CSS animation fired silently within milliseconds.
Wordfence tracked this as a medium-severity XSS issue with a CVSS score of 5.4. The flaw was introduced in Prime Slider version 4.1.9 on March 1, 2026, and spread to other BdThemes products from there. As of the initial reporting, the vulnerability remained unpatched.
The critical detail: conventional file integrity monitoring would not catch this. The plugin files on the server never changed. The malicious payload came from a remote API response that the plugin was designed to trust and render in the browser.
What does the payload do once it fires in an admin's browser?
The primary payload, identified as w2.js, first contacts the command-and-control server at ia-cdn[.]com/fz/c to determine whether the victim site should be targeted. If approved, it uses the active administrator's authenticated WordPress session to create a rogue administrator account through the WordPress REST API or the standard user-creation workflow.
Rogue accounts follow a predictable pattern. Usernames start with bd_ followed by a six-character base36-derived value based on the victim site's hostname. Email addresses often use @wordpress.org or @developer.wordpress.org domains. A secondary payload, x.js, generates passwords formatted as Bd@26!x. This design means attackers can derive credentials for any infected site without maintaining a central victim list, which the same researchers documented in their technical breakdown.
The payload then installs a fake plugin with a benign-sounding name like wp-smart-thumbnails. That plugin contains a webshell called emer-run.php that attackers can invoke directly to execute commands remotely. Persistence extends further through malicious Must-Use plugins placed in the mu-plugins directory:
- A magic-login backdoor that allows unauthenticated administrator access through a
_wploginURL parameter - A stealth module that alters WordPress database queries to hide attacker-created administrator accounts from the normal user list
- A component that adjusts user totals to make the compromise harder to detect
The malware also backdates files to September 2025 to complicate timeline analysis during incident response.
How many sites are affected and which plugins are in scope?
Seven plugins are confirmed affected, and the WordPress Plugins team closed all of them in the official directory on August 8, 2026, pending a full review:
| Plugin slug | Directory status |
|---|---|
bdthemes-element-pack-lite |
Pulled August 8 |
bdthemes-prime-slider-lite |
Pulled August 8 |
pixel-gallery |
Pulled August 8 |
ultimate-post-kit |
Pulled August 8 |
ultimate-store-kit |
Pulled August 8 |
live-copy-paste |
Pulled August 8 |
smart-admin-assistant |
Pulled August 8 |
The two poisoned API endpoints at api.sigmative.io now return clean JSON data as of August 8, but sites that ran the affected plugins during the campaign window remain potentially compromised. The campaign may have started as early as June 23, 2026, based on timestamps in poisoned promotional records. That gives attackers a potential 46-day window of active exploitation before Wordfence discovered the attacks on August 7. The chart below breaks down the full timeline from vulnerable code going live to plugin takedown.
Why did file integrity monitoring miss this entirely?
Standard WordPress security controls are built around file integrity. Scanners compare plugin files against known-good versions in the WordPress.org repository. WAF rules look for malicious patterns in incoming requests. Neither approach catches an attack where the payload lives in a remote JSON response that the plugin fetches and renders as part of its normal operation.
The attack exploits a trust boundary that most security tooling does not monitor: the connection between a plugin and its vendor's external API. The plugin code itself is clean. The WordPress.org repository is clean. The malicious payload transited through a DigitalOcean Spaces bucket behind Cloudflare, rendered in an admin's browser via a JavaScript event handler hidden in an HTML attribute, and then used the admin's own session to escalate privileges.
This is the same class of supply chain attack that hit OptinMonster through a compromised CDN and the Advanced Responsive Video Embedder plugin. Wordfence researchers say the command-and-control infrastructure points to the same attacker behind those earlier compromises. The pattern is now established: compromise a vendor's external data feed, inject code that executes in a trusted admin context, and pivot to full site takeover without ever touching the plugin repository.
Our earlier coverage of the BdThemes attack outlined the initial discovery. The operational reality for site operators is more urgent now that the full persistence mechanism is documented.
What should I check on my WordPress sites right now?
If you run any of the seven affected plugins, treat the site as potentially compromised. The API endpoints may be clean now, but any site that loaded a poisoned response during the campaign window could have a rogue admin account, a webshell, and MU-plugin backdoors in place.
Start with these checks:
Hunt for rogue administrator accounts. Search the wp_users table for usernames matching the pattern bd_ followed by six alphanumeric characters. Check for email addresses using @wordpress.org or @developer.wordpress.org domains. The malware alters database query results to hide these accounts from the admin user list, so query the database directly rather than relying on the WordPress admin UI.
Inspect the Must-Use plugin directory. Look in wp-content/mu-plugins/ for these specific files and hashes:
| File | MD5 hash |
|---|---|
class-wp-token-validate.php |
7719cd98a35ffad2771f26d1ceab7d27 |
class-wp-query-*.php |
9aadc3e5c5242b273bd17c5bdc358845 |
wp-cache-optimizer.php |
e450ae5bc4bfc0d960dded06a76bb8e9 |
Search for the webshell. Look for emer-run.php, MD5 1024732009983dd5e54b4cf5593f04d4, often packaged inside a fake plugin named wp-smart-thumbnails.
Check database options. Search the wp_options table for fz_emer_login_tokens and fz_emer_done_v1. These store the attacker's session tokens and campaign state.
Block the C2 infrastructure. Add firewall rules blocking ia-cdn[.]com and monitor outbound traffic for requests to ia-cdn[.]com/fz/w2.js or ia-cdn[.]com/fz/c.
Disable the affected plugins. Remove or disable all seven BdThemes plugins until the vendor and WordPress.org provide clear guidance on remediation. BdThemes had not published an official statement as of the initial reporting.
If you find any indicators of compromise, the safest path is a full site rebuild from a known-clean backup dated before June 23, 2026. Removing the visible webshell does not remove the hidden admin account or the database-level query manipulation. Assume persistence across every layer.
What separates this from earlier WordPress supply chain attacks?
Most WordPress supply chain attacks involve a compromised plugin update or a directly backdoored plugin file. The ChainDrop npm worm and the VS Code Tasks supply chain attack followed that pattern: malicious code inserted into a package that users then installed or updated.
The BdThemes attack is different in one critical dimension. The plugin files distributed through WordPress.org were never modified. The attack payload was delivered through a runtime data fetch that the plugin performed as part of its normal operation. Reinstalling the plugin from a clean source does not remove the compromise. File integrity scanners monitoring the plugin directory see nothing wrong. The attack persists even after the vendor cleans the API endpoints, because the rogue accounts and webshells are already planted on the site. Sites that installed the plugin months ago and never updated are still vulnerable, because the vulnerability is in how the plugin handles remote data, not in a specific version's local code.
The XSS vulnerability that enabled this has a CVSS score of only 5.4. That medium rating undersells the impact. A medium XSS in an admin-only context that fetches from a vendor-controlled API becomes a full site takeover when the vendor's infrastructure is compromised. Severity scoring does not account for the trust relationship between a plugin and its vendor's backend.
The supply chain now includes your vendor's CDN
The perimeter you need to defend just expanded. Plugin file integrity is no longer sufficient. Every external API call your plugins make is now part of your attack surface, and most WordPress site operators have no visibility into which plugins fetch remote data, where that data comes from, or what happens to it in the browser. The BdThemes attack proves that a single compromised DigitalOcean Spaces bucket can turn 350,000 sites into attacker-controlled infrastructure. Your next security review should include a network audit of every plugin's outbound calls, not just a file scan of what sits on disk.
Sources
- BleepingComputer - BdThemes plugins supply-chain hack creates rogue WordPress admins
- cybersecuritynews.com - New WordPress supply chain attack compromises BdThemes plugins
- gbhackers.com - WordPress supply chain attack exploits BdThemes plugins
- BleepingComputer - WordPress plugin suite hacked to push malware to thousands of sites
