BdThemes Supply-Chain Compromise Creates Rogue WordPress Admins

Summary

Researchers report that attackers poisoned a BdThemes JSON feed, exploiting an XSS flaw to create rogue WordPress admin accounts and reportedly install a webshell. WordPress[.]org removed affected plugins pending review.

Key points

Wordfence reported seeing attacks on August 7; researchers say available records suggest the campaign may have begun as early as June 23.
The attacker reportedly gained write access to BdThemes’ storage and poisoned a remote JSON feed served to WordPress administrators.
Researchers say an XSS flaw in the Biggop Library’s JSON parsing let injected code run when administrators accessed wp-admin pages.
The injected JavaScript reportedly used authenticated administrator sessions to create rogue accounts and hide them from the user list.
A second payload reportedly installed a fake plugin and the emer-run.php webshell to establish persistence.
WordPress[.]org removed affected BdThemes plugins on August 8 pending review; two poisoned API endpoints were returning clean JSON at the time of reporting.
Defiant researchers linked the observed C2 infrastructure to the actor they associate with other supply-chain compromises; BdThemes had not issued a statement at publication.

Article Details

Victim Organization: BdThemes
Incident Type: Supply-chain compromise involving a poisoned remote JSON feed, cross-site scripting, rogue WordPress administrator accounts, and webshell persistence.
Incident Date: 2026-06-23
Operational Impact: Malicious code created rogue administrator accounts and installed a fake plugin to establish persistence via a webshell. The affected plugins were removed from the WordPress.org directory pending review.
Claim Status: confirmed

MITRE ATT&CK

T1059.007 · JavaScriptMalicious JavaScript was injected through the poisoned JSON response and executed in administrators' browsers.T1098 · Account ManipulationThe injected code created rogue administrator accounts on impacted WordPress sites.T1195.002 · Compromise Software Supply ChainThe attacker reportedly compromised BdThemes' upstream infrastructure and poisoned a remote JSON feed used by its plugins.T1505.003 · Web ShellAn additional payload reportedly established persistence by installing a fake plugin containing a webshell.

Vendors

BdThemesA threat actor compromised BdThemes’ upstream infrastructure and poisoned a remote JSON feed, using the attack to create rogue administrator accounts on WordPress sites.

Products

Element PackThe incident affected several BdThemes plugins, including Element Pack, and has been linked by researchers to a broader supply-chain campaign.Pixel GalleryBdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.Prime SliderBdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.Ultimate Post KitBdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.Ultimate Store KitBdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.Wordfence#BdThemes #ElementPack #Wordfence #Sigmative #Biggop Library WordPressA threat actor compromised BdThemes’ upstream infrastructure and poisoned a remote JSON feed, using the attack to create rogue administrator accounts on WordPress sites.