Overview of the BdThemes Supply Chain Compromise
A recent supply chain attack has targeted BdThemes, a prominent developer of premium WordPress web-design tools, leading to the creation of rogue administrator accounts on customer websites. The attack leverages a compromised upstream infrastructure to deliver malicious content via a remote JSON feed, impacting multiple popular plugins. Security firm Defiant, through its Wordfence web application firewall (WAF), observed active exploitation beginning August 7, 2023, though analysis suggests the campaign may have started as early as June 23, 2023.
The sophisticated attack bypasses traditional security measures by exploiting a cross-site scripting (XSS) vulnerability within the plugins’ response-parsing code. This allowed attackers to inject malicious JavaScript, which then creates hidden rogue administrator accounts and establishes persistent webshells on compromised WordPress installations. The affected plugins, including the widely used free Element Pack with over 100,000 active installations, were subsequently removed from the WordPress.org directory on August 8, 2023, pending a full review, according to BleepingComputer.
Technical Analysis: BdThemes Supply Chain Compromise
The BdThemes WordPress plugin supply chain compromise originated from an attacker gaining write access to the vendor’s storage bucket. This access enabled the poisoning of a static remote JSON data stream, which is normally fetched by an administrative promotional banner component within the BdThemes plugins. Instead of legitimate promotional content, the modified JSON feed delivered malicious code.
The XSS Vulnerability in Biggop Library
At the core of this attack is an XSS vulnerability (assigned a ‘medium’ severity score by Defiant) found in the Biggop Library used by the Biggopti component. This component is responsible for retrieving promotional banners from the vendor’s API server (specifically the Sigmative API) and displaying them in the WordPress admin dashboard. The vulnerability exists due to insufficient output escaping for the display_id parameter within the JSON response-parsing code, a flaw reportedly introduced in March 2026 (an unusual future date, likely a typo in the original source, but as stated). Attackers who compromise the Sigmative API server can inject arbitrary web scripts into pages accessed by administrators.
Attack Mechanism and Stealth
The injected malicious JavaScript leverages the legitimate administrator’s authenticated session to create new, unauthorized administrator accounts. Furthermore, an additional payload (w2.js) is deployed to establish persistence by installing a fake plugin that creates a webshell (emer-run.php). This method of detecting rogue WordPress admin accounts is particularly challenging because the injected code actively manipulates WordPress database queries to hide these accounts from the standard user list, making them difficult for site owners to discover.
Crucially, this attack is entirely API-driven, requiring no direct file modification, plugin update, or user interaction on the victim’s part. The payload executes silently every time a logged-in administrator accesses a wp-admin page, ensuring widespread and stealthy compromise across affected sites. The nature of the exploit means administrators seeking Biggop Library XSS vulnerability mitigation cannot simply update their plugins via the standard WordPress dashboard if the malicious feed is still active, emphasizing the need for manual removal and verification.
Connections to Prior Incidents
Wordfence researchers indicate that the command-and-control (C2) infrastructure used in these observed attacks appears to be linked to the same threat actor responsible for recent supply chain compromises involving the Advanced Responsive Video Embedder and OptinMonster WordPress plugins. This suggests a pattern of targeting plugin vendor infrastructure to achieve broad distribution of malicious payloads.
Recommendations for Defenders
Administrators of WordPress sites using BdThemes plugins should take immediate action to secure their environments.
Immediate Actions
- Remove Affected Plugins: As BdThemes plugins have been pulled from the WordPress.org directory, immediately deactivate and delete any BdThemes plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. Do not simply deactivate; full removal is critical.
- Verify User Accounts: Thoroughly audit all WordPress user accounts, paying close attention to any unfamiliar administrator-level users. Even if not visible in the dashboard, manual database inspection might be necessary if compromise is suspected.
- Scan for Webshells: Conduct a comprehensive scan of your WordPress installation files for webshells or suspicious PHP files, especially
emer-run.php, and other unexpected files in plugin directories. - Update All Software: Ensure your WordPress core, themes, and all other plugins are updated to their latest versions to protect against other known vulnerabilities.
- Change API Keys and Credentials: If any API keys or credentials were used by the BdThemes plugins, consider them compromised and change them immediately.
Ongoing Monitoring and Best Practices
- Implement a WAF: Utilize a Web Application Firewall (WAF) like Wordfence to help detect and block malicious requests, even those targeting supply chain vectors.
- Regular Backups: Maintain regular, verified backups of your website data and files to facilitate recovery in case of a compromise.
- Principle of Least Privilege: Ensure that all users and applications operate with the minimum necessary permissions.
Related: OptinMonster 2.6.5 Update: Managing CDN Supply Chain Attack Risks, WordPress Sites Targeted via Kirki and Burst Statistics Vulnerabilities