Reported by 2 outlets

Timeline

1. original reporting

   BDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys Webshells

   cyberpress.org · 64d ago · August 10th, 2026

   A supply chain compromise has hit BdThemes, a popular WordPress plugin vendor, allowing attackers to silently create rogue administrator accounts and install webshells on affected sites without modifying a single line of plugin code. The Wordfence Team was alerted to the campaign on August 7, 2026, and all impacted plugins have since been pulled from the WordPress repository pending investigation. Unlike conventional plugin supply chain breaches, no source code in the official WordPress repository was altered BDThemes WordPress Supply Chain Attack Instead, threat actors poisoned a static JSON data stream fetched by “Biggopti,” an internal promotional banner system used across BdThemes plugins including Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant. The Biggopti script runs on every wp-admin page load for logged-in administrators, fetching banner data from a DigitalOcean Spaces bucket. A cross-site scripting flaw in how the script handled the display_id field, introduced in Prime Slider v4.1.9 on March 1, 2026, left an HTML id attribute unescaped while a neighboring field was properly sanitized. Attackers who gained write access to the vendor’s storage bucket exploited this gap by injecting a malicious payload triggered via an onanimationstart event handler, firing within 10 milliseconds of page load. Once triggered, the injected script runs a multi-stage attack inside the administrator’s authentica

2. update from bleepingcomputer.com

   BdThemes plugins supply-chain hack creates rogue WordPress admins

   bleepingcomputer.com · 64d ago · August 10th, 2026

   A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers to create rogue admin accounts. Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review. Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs . WordPress security firm Defiant started seeing attacks through its Wordfence web application firewall (WAF) on August 7. The researchers say that the attacker "poisoned a static remote JSON data stream fetched by an administrative promotional banner component" after obtaining write access to the vendor's storage bucket. According to the researchers, the plugin developer had introduced a cross-site scripting (XSS) vulnerability in the JSON response parsing code, allowing the attacker to replace the legitimate promotional JSON with malicious code that exploited the security issue.