Critical WordPress Supply Chain Attack Compromises Themes via Poisoned API Response

Key Takeaways

• A supply chain attack targeted several popular BdThemes WordPress plugins.
• Attackers poisoned a remote promotional API feed, leading to cross-site scripting (XSS) in vulnerable plugins.
• The compromise enabled rogue administrator account creation, webshell deployment, and persistent backdoors.
• The WordPress Plugins team has temporarily closed affected plugins for investigation.
• Affected site administrators must perform thorough post-compromise investigations.

A sophisticated supply chain attack has impacted multiple BdThemes WordPress plugins, exposing website administrators to severe risks including account takeovers, webshell installations, and persistent backdoors. The incident highlights the vulnerabilities inherent in relying on external data feeds, even when local plugin code remains uncompromised.

Attack Vector: Poisoned API Response

The attack came to light on August 7, 2026, when Wordfence Threat Intelligence discovered that malicious actors had tampered with a remote promotional API feed. This feed, crucial for several widely-used BdThemes plugins, was hosted in a DigitalOcean Spaces bucket and protected by Cloudflare. Crucially, the attackers did not modify the actual plugin source code stored in the WordPress.org repository, making this a particularly stealthy compromise.

The affected plugins include:

• Element Pack Addons for Elementor
• Prime Slider Addons for Elementor
• Pixel Gallery Addons for Elementor
• Ultimate Post Kit
• Ultimate Store Kit
• Live Copy Paste
• Smart Admin Assistant

Following the discovery, the WordPress Plugins team temporarily removed these plugins from the official directory while their investigation proceeds.

The Cross-Site Scripting Vulnerability

The core of the attack leveraged a component within BdThemes plugins called Biggopti. This component is responsible for fetching promotional banners from the compromised remote API and displaying them within the WordPress admin dashboard. Researchers found that Biggopti failed to properly sanitize the display_id value from the JSON response before embedding it into an HTML id attribute. This oversight created a cross-site scripting (XSS) vulnerability, tracked by Wordfence with a CVSS score of 5.4.

Attackers who gained write access to the vendor’s storage bucket could inject malicious display_id values into the legitimate banner data. When a logged-in WordPress administrator navigated to any wp-admin page, the poisoned API response triggered malicious JavaScript execution in their browser. The payload utilized an onanimationstart event handler, cleverly concealed within the injected HTML attribute, allowing it to execute silently and rapidly.

Malicious Payload and Persistence Mechanisms

The initial JavaScript payload then fetched additional scripts from attacker-controlled infrastructure. The primary payload, identified as w2.js, first communicated with a command-and-control server at ia-cdn[.]com/fz/c to ascertain if the victim was a target. If approved, it exploited the active administrator’s WordPress nonce to create a new, rogue administrator account.

Further compromise involved the installation of a deceptive plugin, often named innocuously like “wp-smart-thumbnails.” This fake plugin contained a webshell, emer-run.php, providing attackers with direct remote command execution capabilities. For persistence, the webshell installed malicious Must-Use plugins. One such component established a “magic-login” backdoor, granting unauthenticated administrative access via a specially crafted URL parameter. Another sophisticated tactic involved manipulating WordPress database queries to conceal the attacker-created administrator accounts from the standard user list and altering user totals to evade detection.

A secondary payload, x.js, generated predictable administrator credentials derived from the victim site’s hostname. These accounts typically used usernames beginning with “bd_” followed by a 6-character hash and often featured @wordpress.org email addresses. This design allowed attackers to regenerate credentials for compromised sites without needing to maintain a centralized list of victims.

Wordfence said that evidence suggests the campaign may have commenced as early as June 23, 2026, based on timestamps found in the poisoned promotional records. Although the compromised API endpoints were cleaned on August 8, administrators whose sites ran the affected plugins must conduct thorough investigations.

What You Should Do

• Review Administrator Accounts: Immediately audit all WordPress administrator accounts for any unauthorized or suspicious entries.
• Inspect Plugins and Directories: Examine all installed plugins, paying close attention to the Must-Use plugin directory (wp-content/mu-plugins/) for unfamiliar or malicious files.
• Search for Malicious Files: Actively search your server for files named emer-run.php, any suspicious class-wp-query-* files, and the database option fz_emer_login_tokens.
• Update and Patch: While the plugin source code wasn’t compromised, ensure all other plugins, themes, and your WordPress core are fully updated to the latest versions.
• Implement Strong Security Measures: Use a reputable security plugin, enforce strong passwords, and consider two-factor authentication for all administrative accounts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.