BdThemes WordPress Plugins Compromised Via Poisoned API Response
Threat actors injected malicious scripts into BdThemes WordPress plugins by poisoning a static JSON data stream, leading to the creation of rogue admin accounts and webshells.
BdThemes, a vendor of popular WordPress plugins, has been subjected to a supply chain compromise that allowed threat actors to inject malicious scripts into its ecosystem. The attack did not involve modifying source code within the official WordPress.org repository. Instead, attackers targeted a static JSON data stream used for administrative promotional banners, a method that bypasses traditional file integrity scanners and many web application firewalls.
The vulnerability stems from a Cross-Site Scripting (XSS) flaw within the Biggopti library, an internal system used by BdThemes plugins to pull promotional content from their API server. This API is served from a static DigitalOcean Spaces bucket protected by Cloudflare. The vulnerability was introduced in the code that parses the JSON response, specifically in how the display_id parameter was handled. Threat actors gained write access to the storage bucket and replaced legitimate JSON responses with malicious payloads.
When an administrator loads any page within the WordPress dashboard, the compromised script executes silently. This script leverages the XSS vulnerability to break out of an HTML id attribute, injecting an onanimationstart event handler. This handler is triggered by a CSS animation, allowing the malicious script to run within milliseconds of the page load, often before the user can even perceive any change.
Once executed, the injected script performs several malicious actions. It silently creates rogue administrator accounts on the affected WordPress sites, providing attackers with persistent access. Furthermore, it uploads a webshell plugin, which acts as a backdoor, allowing attackers to execute arbitrary commands on the server. The compromised site then phones home to a command-and-control (C2) server, reporting its infection and awaiting further instructions.
Crucially, this attack does not require any plugin updates to affect a user. No files are modified on the victim's disk, making it particularly stealthy. The attack is entirely API-driven, making it difficult to detect through conventional security measures that rely on file system monitoring or signature-based detection of modified code.
While a DOMParser-based sanitizer was later introduced to clean the content field of the banner, the id attribute injection remained unescaped, allowing the exploit to persist. The vulnerability was first introduced on March 1st, 2026, in Prime Slider (bdthemes-prime-slider-lite) version 4.1.9 and subsequently propagated to other BdThemes plugins that utilize the Biggopti system.
Affected plugins include Element Pack Lite, Live Copy Paste, Pixel Gallery, Prime Slider Lite, Smart Admin Assistant, Ultimate Post Kit, and Ultimate Store Kit. All these plugins have been temporarily removed from the WordPress.org repository pending a full investigation and remediation by the WordPress Plugins team. Users are advised to monitor their sites for suspicious activity and consider removing the affected plugins if they are not actively managed by a security service.