BdThemes Compromised: WordPress Supply-Chain Attack Creates Rogue Administrator Accounts

Promotional Feed Becomes an Attack Vector

On August 10, 2026, at 17:12, a compromise of BdThemes’ upstream infrastructure was reported. The company develops premium tools for WordPress.

The attack altered a remote JSON feed displayed in administrator dashboards. The replacement content contained malicious JavaScript that executed in the browsers of authenticated administrators.

Defiant, through the Wordfence WAF, observed attacks beginning on August 7. The earliest possible start of the campaign was traced back to June 23.

Affected Plugins and Components

The BdThemes ecosystem claims more than 350,000 active installations. The affected products include:

• Element Pack, with more than 100,000 active installations on WordPress.org;
• Prime Slider;
• Ultimate Post Kit;
• Pixel Gallery;
• Ultimate Store Kit.

The exact affected versions have not been disclosed.

The vulnerability affects the Biggop library, the Biggopti component, the Sigmative API, and the display_id parameter. An XSS flaw introduced in March 2026 allowed arbitrary code execution while parsing the JSON response.

The plugins were removed from WordPress.org on August 8 and suspended for a full review. They have not been available for download since then.

How the Compromise Works

The attacker obtained write access to the vendor’s storage bucket and replaced the legitimate promotional JSON with one containing malicious code.

When an authenticated administrator opens a wp-admin page, the payload abuses the active session to create new administrator accounts. This operation requires no user interaction and does not involve modifying or updating the plugin files.

An additional payload, w2.js, installs the fake plugin emer-run.php, which provides persistence through a web shell. The code also manipulates WordPress database queries to hide the created accounts from the administrator user list.

The campaign is therefore controlled through the compromised API. The two affected endpoints now return legitimate JSON, but restoring the feed does not remove accounts or files that may already have been installed.

The observed C2 infrastructure shows links to the same threat actor associated with the supply-chain compromises of Advanced Responsive Video Embedder and OptinMonster. The vulnerability was classified as medium severity and remained unpatched at the time of publication.

Checks and Immediate Mitigation Measures

No official patch has been reported yet. Administrators should:

• suspend or remove the affected BdThemes plugins;
• check for recently created or unrecognized administrator accounts;
• search for the fake plugin emer-run.php and the w2.js file;
• check for indicators associated with the C2 infrastructure;
• review access logs for wp-admin pages;
• rotate administrator credentials after remediation.

BdThemes had not yet published an official statement or provided an update on the vulnerability fix.