Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes. The incident prompted the WordPress plugins team to temporarily disable downloads for seven affected plugins.
"Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository," Wordfence researcher Paolo Tresso said. "Instead, threat actors poisoned a static remote JSON data stream fetched by an administrative promotional banner component."
The BdThemes WordPress supply chain attack is notable for its unusual approach. No plugin code was modified. The attack happened entirely through a compromised API. Let me walk through how the BdThemes WordPress supply chain attack worked, which plugins were affected, and what site owners need to know.
The Affected Plugins
The BdThemes WordPress supply chain attack affected seven plugins:
- Element Pack Addons for Elementor (100,000+ active installs)
- Live Copy Paste for Elementor (6,000+ active installs)
- Pixel Gallery Addons for Elementor
- Prime Slider Addons for Elementor
- Smart Admin Assistant
- Ultimate Post Kit Addons for Elementor
- Ultimate Store Kit for WooCommerce (6,000+ active installs)
Users visiting the listings for these plugins on the WordPress plugins directory see a message that they have been closed and are not available for download pending a "full review."
The Attack Mechanism
The BdThemes WordPress supply chain attack is rooted in an internal component called Biggopti that ships with the plugins. This system pulls promotional banners from an API server and renders them in the WordPress admin dashboard by fetching relevant JSON files from a DigitalOcean Spaces bucket.
The library is vulnerable to a cross-site scripting flaw in the JSON response parsing code via the "display_id" parameter. Due to insufficient client-side escaping, an attacker who can compromise the API can inject arbitrary web scripts in pages that execute every time a user accesses those pages.
Because the script runs on every "wp-admin" page load, the injected code activates silently in the browser of any logged-in administrator. The vulnerability is rated 5.4 on the CVSS scoring system, indicating medium severity.
This change was introduced for the first time on March 1, 2026, in "bdthemes-prime-slider-lite" and then being applied to other plugins. The BdThemes WordPress supply chain attack is entirely driven via the API and requires no plugin updates or files to be modified on disk.
The JSON Poisoning
The attackers obtained write access to the DigitalOcean Spaces bucket. They replaced the legitimate JSON responses with crafted payloads to exploit the XSS vulnerability. The BdThemes WordPress supply chain attack was delivered using the "api-data-all-records" API endpoint.
The XSS fires inside every logged-in admin's browser, silently, on every wp-admin page load. From there, the injected script creates rogue administrator accounts, uploads a web shell plugin, and phones home to a command-and-control server.
Payload of JavaScript: w2.js
The main payload in the BdThemes WordPress Supply Chain Attack includes a JavaScript file known as "w2.js".
The payload executes multiple actions:
- Contacting the C2 server for the instructions for targeting with the origin of the victim website.
- A new rogue admin user is created through WordPress REST API
- A malicious ZIP file of a plugin is downloaded from the C2 server and installed through the standard plugin upload form
- Deploy a PHP web shell called "emer-run.php"
- Installs two persistence modules in the mu-plugins directory
The first persistence module is a "magic-login backdoor" that allows unauthenticated administrative entry via a URL parameter. It targets the longest registered admin on the website.
The second is an anti-analysis module that hooks itself to WordPress database queries, hiding the existence of the rogue user accounts from the administration users list and showing the total number of users without them.
Alternate Payload: x.js
Another payload named "x.js" was identified, running on the infrastructure maintained by the developers of the plugin. This payload is delivered to the victims via "api-data-records" API.
This payload generates "deterministic" administrative credentials mathematically derived from the victim website's hostname. The algorithm generates predictable usernames (bd_ followed by a 6-character hash) and passwords (Bd@26! followed by the hash and x).
Because the credentials are deterministic, threat actors do not need to store compromised site lists centrally. Incident responders can compute the exact username and password to hunt for on suspected domains.
The Connection to Other Attacks
The BdThemes WordPress supply chain attack is assessed to be related to two other software supply chain attacks involving Advanced Responsive Video Embedder and OptinMonster in recent months. In those cases, the WordPress plugins were backdoored to grant full administrative access to unauthenticated attackers.
The end goal of the BdThemes WordPress supply chain attack is to establish covert administrative persistence and remote code execution across WordPress environments.
The Upstream Compromise
The fact that malicious JSON records and the secondary x.js payload were uploaded directly into the vendor's own bucket indicates a severe upstream compromise of BdThemes' cloud storage credentials or internal infrastructure.
The BdThemes WordPress supply chain attack was not a code modification attack. It was a credential compromise that allowed the attackers to poison the JSON data stream.
The WordPress XSS2Shell Flaw
The BdThemes WordPress supply chain attack comes days after WordPress addressed a pre-authentication reflected XSS flaw tracked as CVE-2026-64638. The vulnerability, nicknamed XSS2Shell, carries a CVSS score of 8.9. It can be exploited to achieve PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.
What Site Owners Should Do
The BdThemes WordPress supply chain attack requires immediate action from users of the affected plugins. The plugins have been temporarily disabled from the WordPress directory. Users should check if they have any of the affected plugins installed.
If you have any of the affected plugins installed, you should:
- Review administrator accounts for unrecognized users
- Check for the presence of rogue admin accounts with bd_ prefixes
- Look for the "emer-run.php" web shell
- Check the mu-plugins directory for unexpected files
- Review your site's user list for hidden accounts
- Consider changing all administrative passwords
The deterministic nature of credentials used in the BdThemes WordPress supply chain attack implies that the incident response team will be able to compute the exact username and password used. It will assist in detecting any compromised websites.
Conclusion
The BdThemes attack on the WordPress supply chain is an atypical one where code was not altered but where attackers manipulated a JSON API in the BdThemes plugin to inject malware into the admin dashboard.
The affected plugins include Element Pack, Live Copy Paste, and five others. The attack creates rogue administrator accounts, deploys web shells, and establishes persistence through mu-plugins.
The BdThemes WordPress supply chain attack is connected to other recent WordPress supply chain compromises. Site owners should review their installations and remove any affected plugins.
FAQ Section
What is the BdThemes WordPress supply chain attack?
It is a supply chain compromise where attackers poisoned a JSON API used by BdThemes plugins. The attack will inject malicious scripts, which generate rogue admin accounts and install web shells.
Which plugins are affected?
Seven plugins are affected including Element Pack Addons (100,000+ installs), Live Copy Paste, Prime Slider, and Ultimate Store Kit. The plugins have been temporarily disabled on WordPress.org.
How did the attack work?
The attackers got write access to the DigitalOcean Spaces bucket, thus replacing the JSON response with a malicious payload. The XSS vulnerability in the Biggopti library will trigger the payload whenever an admin accesses any page of wp-admin.
What does the payload do?
The payload creates rogue administrator accounts, deploys a web shell, injects a magic-login backdoor, and installs hidden modules for hiding the rogue users from the admin list.
How do I detect if my website is hacked?
Watch out for administrator accounts having prefixes bd_, "emer-run.php" webshell file, and random files inside the mu-plugins directory. The deterministic credentials can be determined in order to detect hacked websites.
