A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers to create rogue admin accounts.
Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review.
BdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs.
How the Attack Worked
WordPress security firm Defiant started seeing attacks through its Wordfence web application firewall (WAF) on August 7.
The researchers say that the attacker “poisoned a static remote JSON data stream fetched by an administrative promotional banner component” after obtaining write access to the vendor’s storage bucket.
The attack was enabled by a coding flaw introduced in March 2026 in the JSON response-parsing code, which created a cross-site scripting (XSS) vulnerability in the BdThemes infrastructure. The flaw resides in the Biggop Library used by the Biggopti component, which is responsible for fetching promotional banners from the vendor’s API server and displaying them in the customers’ WordPress admin dashboard.
Wordfence researchers explain that the vulnerability stems from insufficient output escaping of the display_id parameter from the Sigmative API:
“The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
The malicious JavaScript injection uses the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites. An additional payload (w2.js) establishes persistence via a webshell (emer-run.php) by installing a fake plugin.
The malicious API response — Source: Wordfence
Stealthy by Design
Because the attack is entirely API-driven and requires no user interaction, file modification, or plugin update, it is completely stealthy. The payload executes every time a logged-in administrator opens a wp-admin page.
The injected code also manipulates WordPress database queries to hide rogue administrator accounts from the user list, making the compromise more difficult to detect. The issue was assigned a “medium” severity score and remains unpatched as of publication.
Scope and Attribution
After discovering the attacks, Defiant’s researchers analyzed available records and determined that the earliest possible start of the campaign was June 23. Wordfence researchers report that the command-and-control (C2) infrastructure used in the observed attacks points to the same attacker behind the recent Advanced Responsive Video Embedder and OptinMonster supply-chain compromises.
The affected plugins were pulled from the WordPress.org directory on August 8 pending investigation, while two poisoned API endpoints have since been updated to return clean JSON data. At the time of writing, BdThemes has not published an official statement about the incident, and the company did not respond to BleepingComputer’s request for comment.
