BdThemes WordPress Plugins Compromised Via Poisoned API Response
Threat actors injected malicious scripts into BdThemes WordPress plugins by poisoning a static JSON data stream, leading to the creation of rogue admin accounts and webshells.
BdThemes, a vendor of popular WordPress plugins, has been subjected to a supply chain compromise that allowed threat actors to inject malicious scripts into its ecosystem. The attack did not involve modifying source code within the official WordPress.org repository. Instead, attackers targeted a static JSON data stream used for administrative promotional banners, a method that bypasses traditional file integrity scanners and many web application firewalls.
The vulnerability stems from a Cross-Site Scripting (XSS) flaw within the Biggopti library, an internal system used by BdThemes plugins to pull promotional content from their API server. This API is served from a static DigitalOcean Spaces bucket protected by Cloudflare. The vulnerability was introduced in the code that parses the JSON response, specifically in how the display_id parameter was handled. Threat actors gained write access to the storage bucket and replaced legitimate JSON responses with malicious payloads.
When an administrator loads any page within the WordPress dashboard, the compromised script executes silently. This script leverages the XSS vulnerability to break out of an HTML id attribute, injecting an onanimationstart event handler. This handler is triggered by a CSS animation, allowing the malicious script to run within milliseconds of the page load, often before the user can even perceive any change.
Once executed, the injected script performs several malicious actions. It silently creates rogue administrator accounts on the affected WordPress sites, providing attackers with persistent access. Furthermore, it uploads a webshell plugin, which acts as a backdoor, allowing attackers to execute arbitrary commands on the server. The compromised site then phones home to a command-and-control (C2) server, reporting its infection and awaiting further instructions.
Crucially, this attack does not require any plugin updates to affect a user. No files are modified on the victim's disk, making it particularly stealthy. The attack is entirely API-driven, making it difficult to detect through conventional security measures that rely on file system monitoring or signature-based detection of modified code.
While a DOMParser-based sanitizer was later introduced to clean the content field of the banner, the id attribute injection remained unescaped, allowing the exploit to persist. The vulnerability was first introduced on March 1st, 2026, in Prime Slider (bdthemes-prime-slider-lite) version 4.1.9 and subsequently propagated to other BdThemes plugins that utilize the Biggopti system.
Affected plugins include Element Pack Lite, Live Copy Paste, Pixel Gallery, Prime Slider Lite, Smart Admin Assistant, Ultimate Post Kit, and Ultimate Store Kit. All these plugins have been temporarily removed from the WordPress.org repository pending a full investigation and remediation by the WordPress Plugins team. Users are advised to monitor their sites for suspicious activity and consider removing the affected plugins if they are not actively managed by a security service.
This new report details the specific technical mechanisms used in the BdThemes supply chain attack, including the exploitation of a cross-site scripting vulnerability (CVSS 5.4) via a poisoned API response from a compromised DigitalOcean Spaces bucket. It further elaborates on the payloads, such as w2.js and x.js, which were used to establish webshells, install persistence mechanisms like magic-login backdoors, and create rogue administrator accounts with predictable credentials. The article also provides specific indicators of compromise for administrators to audit, including suspicious file names and database options.
This new report details the specific technical mechanism by which the BdThemes WordPress plugins were compromised, identifying an unescaped field in a banner notice as the root cause. It further elaborates on the persistence modules deployed by the attackers, including one that grants unauthenticated administrative access and another designed to hide rogue accounts from the user list. The article also attributes the attack to actors previously linked to other WordPress plugin compromises, adding a layer of threat actor intelligence.
This new report details how attackers achieved persistence by injecting a JavaScript file named 'w2.js' via the 'api-data-all-records' endpoint. This payload establishes communication with a command-and-control server, creates rogue administrator accounts through the WordPress REST API, and deploys a PHP web shell named 'emer-run.php'. Furthermore, it installs two persistence modules in the Must-Use plugins directory: a 'magic-login backdoor' for unauthenticated access and an anti-analysis stealth module to conceal the rogue accounts.