A supply chain compromise has hit BdThemes, a popular WordPress plugin vendor, allowing attackers to silently create rogue administrator accounts and install webshells on affected sites without modifying a single line of plugin code.
The Wordfence Team was alerted to the campaign on August 7, 2026, and all impacted plugins have since been pulled from the WordPress repository pending investigation.
Unlike conventional plugin supply chain breaches, no source code in the official WordPress repository was altered
BDThemes WordPress Supply Chain Attack
Instead, threat actors poisoned a static JSON data stream fetched by “Biggopti,” an internal promotional banner system used across BdThemes plugins including Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant.
The Biggopti script runs on every wp-admin page load for logged-in administrators, fetching banner data from a DigitalOcean Spaces bucket.
A cross-site scripting flaw in how the script handled the display_id field, introduced in Prime Slider v4.1.9 on March 1, 2026, left an HTML id attribute unescaped while a neighboring field was properly sanitized.
Attackers who gained write access to the vendor’s storage bucket exploited this gap by injecting a malicious payload triggered via an onanimationstart event handler, firing within 10 milliseconds of page load.
Once triggered, the injected script runs a multi-stage attack inside the administrator’s authenticated browser session.
It first checks in with a command-and-control server at ia-cdn[.]com to receive targeting instructions, then uses the active session’s REST API nonce to silently create a new administrator account.
Next, it uploads a disguised plugin ZIP, using neutral-sounding slugs such as “wp-smart-thumbnails,” which contains a webshell named emer-run.php.
That webshell then installs two Must-Use plugins backdated to September 2025 for persistence: a magic-login backdoor that grants unauthenticated administrative entry via a ?_wplogin= URL token, and a stealth module that hides the rogue accounts from the admin user list. All results are exfiltrated back to the C2 server via navigator.sendBeacon.
A secondary payload, hosted directly on BdThemes’ own infrastructure, generates deterministic administrator credentials mathematically derived from each victim’s hostname, producing usernames prefixed bd_ followed by a base36 hash.
This deterministic scheme lets attackers avoid maintaining a centralized victim list, while also giving defenders a predictable pattern to hunt for during incident response.
Wordfence links the C2 infrastructure to the same threat actors behind the recent Advanced Responsive Video Embedder backdoor and the OptinMonster and TrustPulse script-tampering incidents from the past two months.
The direct upload of malicious JSON and JavaScript into BdThemes’ own storage bucket points to a serious compromise of the vendor’s cloud credentials or internal infrastructure, rather than an issue with a third-party CDN.
Wordfence Premium, Care, and Response customers, along with paid Wordfence CLI users, received detection signatures and WAF rules on August 7, 2026, while free users will get them after the standard 30-day delay.
Both poisoned API endpoints were reportedly serving clean JSON again as of August 8. Site owners running any affected BdThemes plugin should immediately audit their user lists for accounts with @wordpress.org emails or bd_-prefixed usernames, inspect the mu-plugins directory for unfamiliar files, and check the database for the fz_emer_login_tokens and fz_emer_done_v1 options tied to this campaign.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
