Wordfence Details BdThemes Supply-Chain Attack Using Poisoned JSON
Summary
Wordfence says attackers poisoned JSON from BdThemes’ cloud storage to exploit XSS in WordPress plugins, create rogue admins, deploy a web shell and persistence modules. WordPress temporarily disabled downloads for seven affected plugins.
Key points
- WordPress temporarily disabled downloads for seven BdThemes plugins pending review.
- Wordfence says attackers poisoned remote JSON in a vendor cloud-storage bucket; no files in the official WordPress.org repository were modified.
- The Biggopti component’s JSON parsing reportedly had an XSS flaw involving the display_id parameter, allowing injected scripts to run on logged-in administrators’ wp-admin pages.
- The w2.js payload reportedly contacted ia-cdn[.]com, created rogue administrator accounts, installed a fake plugin containing a PHP web shell, and added persistence modules.
- An alternate x.js payload reportedly generated predictable administrator credentials from a site’s hostname and sent attack results to the C2 server.
- Wordfence assessed the cloud-storage access as evidence of a serious compromise of BdThemes’ credentials or internal infrastructure.
Article Details
- Attack Vectors
- Attackers with write access to BdThemes' remote JSON bucket replaced legitimate responses with crafted payloads, exploiting an XSS flaw in Biggopti's parsing of the display_id parameter.
- Injected JavaScript ran in logged-in administrators' wp-admin browsers, created rogue administrator accounts, downloaded and installed a fake plugin containing a PHP web shell, and installed persistence modules.
- An alternate payload generated deterministic administrator credentials from the victim site's hostname, created a malicious administrator account, and sent attack results to a C2 server.
- Defensive Notes
- WordPress temporarily disabled downloads of the affected BdThemes plugins pending a full review.
- Wordfence said the deterministic credential algorithm allows incident responders to compute the generated username and password when hunting on suspected sites.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article says results of the attack were exfiltrated back to the C2 server.T1059.007 · JavaScriptThe w2.js and x.js payloads used JavaScript injected through the poisoned JSON to perform malicious actions in administrators' browsers.T1071.001 · Web ProtocolsThe payload contacted the C2 server at ia-cdn[.]com/fz/c to fetch targeting instructions.T1105 · Ingress Tool TransferThe payload downloaded a fake plugin ZIP from the C2 server and installed it through the plugin upload form.T1136.001 · Local AccountThe injected scripts created rogue WordPress administrator accounts, including accounts with credentials derived from the victim site's hostname.T1195.002 · Compromise Software Supply ChainAttackers poisoned remote JSON data used by BdThemes plugins after obtaining write access to the vendor's bucket.T1505.003 · Web ShellThe installed fake plugin deployed a PHP web shell named emer-run.php.T1565.001 · Stored Data ManipulationAttackers replaced legitimate JSON responses in the bucket with crafted malicious payloads.
CVE
CVE-2026-18072The C2 server used in the campaign is assessed to be related to two other software supply chain attacks involving Advanced Responsive Video Embedder (CVE-2026-18072) and OptinMonster in recent months.CVE-2026-64638The development comes days after WordPress addressed a pre-authentication reflected XSS flaw (CVE-2026-64638 aka XSS2Shell, CVSS score: 8.9) that can be exploited to achieve PHP code execution on the server when a
People
Vendors
Products
BiggoptiThe attack leveraged the Biggopti component to trigger XSS in wp-admin, enabling rogue administrator creation, web shell deployment, and persistent backdoor access.Element Pack Addons for ElementorElement Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] – 100,000+ active installsLive Copy Paste for ElementorLive Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste] – 6,000+ active installsPixel Gallery Addons for ElementorPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery [pixel-gallery] – N/APrime Slider Addons for ElementorPrime Slider Addons for Elementor – Widgets, Templates & Elementor Addons [bdthemes-prime-slider-lite] – N/ASmart Admin AssistantSmart Admin Assistant – Dashboard and Site Enhancements [smart-admin-assistant] – N/AUltimate Post Kit Addons for ElementorUltimate Post Kit Addons for Elementor [ultimate-post-kit] – N/AUltimate Store KitUltimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit] – 6,000+ active installsWordPressCybersecurity researchers uncovered a supply chain compromise at BdThemes that poisoned remote JSON data used by several WordPress plugins, leading WordPress to temporarily disable downloads pending review.