BdThemes Supply Chain Attack Poisons JSON to Spawn Rogue WordPress Admins

Cybersecurity researchers at Wordfence have disclosed a sophisticated supply chain attack targeting WordPress plugin vendor BdThemes, prompting the WordPress.org plugins team to temporarily disable downloads for at least seven affected extensions. The impacted plugins include Element Pack Addons for Elementor (100,000+ active installs), Live Copy Paste for Elementor (6,000+ active installs), Pixel Gallery Addons for Elementor, Prime Slider Addons for Elementor, Smart Admin Assistant, Ultimate Post Kit, and Ultimate Store Kit (6,000+ active installs). Listings for each plugin currently display a closure notice dated either August 7 or August 8, 2026, pending a full review.

According to Wordfence researcher Paolo Tresso, the attack differs from conventional supply chain compromises because no source code files within the official WordPress.org repository were modified. Instead, threat actors poisoned a static remote JSON data stream fetched by an internal component called Biggopti, which renders promotional banners in the WordPress admin dashboard. The library pulls banner data from a DigitalOcean Spaces bucket via the Sigmative API, and a cross-site scripting (XSS) vulnerability in the JSON response parsing code—triggerable through the "display_id" parameter due to insufficient client-side escaping—allowed attackers to inject arbitrary web scripts. Rated 5.4 on the CVSS scale, the flaw was first introduced on March 1, 2026, in bdthemes-prime-slider-lite before spreading to other plugins. Security teams auditing their own web properties can validate external endpoints by running a quick SSL/TLS checker against any third-party API integrations.

Once attackers obtained write access to the DigitalOcean Spaces bucket, they replaced legitimate JSON responses with crafted payloads that exploited the XSS flaw. Because the script executes on every wp-admin page load, the injected code activates silently in the browser of any logged-in administrator, enabling the creation of rogue admin accounts without requiring plugin updates or on-disk file modifications. WordPress site owners should immediately audit their admin user lists for unfamiliar accounts, rotate privileged credentials, and verify that no unauthorized modifications were made during the exposure window. Admins who suspect their email breach may have exposed associated credentials should also verify if administrator emails appear in known credential dumps.

Site administrators running any of the affected BdThemes plugins are urged to remove or disable them until an official patched release lands, review audit logs for unexpected admin creation events, and force a password reset on all privileged accounts. Wordfence customers received a firewall rule on August 1, 2026, to block exploitation attempts, but the broader ecosystem remains exposed. Researchers are treating the incident as a reminder that even unaudited third-party API dependencies—outside the plugin codebase itself—can serve as a viable attack surface for full CMS compromise. Site owners can perform a broader privacy checkup to identify additional external services pulling data into their admin dashboards.