An invisible compromise, without updates or interaction

A malicious actor compromised the upstream infrastructure of BdThemes, a developer of premium web design tools for WordPress, and modified a remote JSON feed delivered directly to administrators' browsers to create ghost administrator accounts on the affected sites. From Saturday, August 8, 2026, the affected BdThemes plugins were removed from the WordPress.org directory, pending a complete security review.

BdThemes offers several popular plugins — Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery and Ultimate Store Kit. Its flagship free plugin Element Pack alone boasts more than 100,000 active installations on WordPress.org, and the publisher claims a total portfolio of over 350,000 active installations.

The mechanism: a poisoned promotional feed

The WordPress security company Defiant, via its product Wordfence, began detecting attacks through its web application firewall (WAF) as early as August 7, 2026. According to researchers, the attacker gained write access to the vendor's storage bucket and then “poisoned a static remote JSON data feed”, retrieved by an administrative promotional banner component.

A programming flaw introduced in March 2026 in the JSON response parsing code created a cross-site scripting (XSS) vulnerability within the BdThemes infrastructure. The flaw is located in the Biggop library, used by the Biggopti component responsible for fetching promotional banners from the vendor's API server and displaying them in WordPress administrators' dashboards.

“The Biggop library is vulnerable to cross-site scripting via the 'display_id' parameter of the Sigmative API, due to insufficient output escaping,” the Wordfence researchers clarify. “This allows an attacker who has compromised the Sigmative API server to inject arbitrary web scripts that will execute every time a user accesses an injected page.”

A stealthy and persistent attack

The injected malicious JavaScript exploits the authenticated session of the legitimate administrator to create rogue administrator accounts on the compromised sites. An additional payload (w2.js) then establishes persistence via a webshell (emer-run.php) by installing a fake plugin.

Because the attack is entirely API-driven — with no interaction, no file modification, and no plugin updates — it is extremely difficult to detect. The payload executes every time a logged-in administrator opens a wp-admin page. Worse still, the injected code manipulates WordPress database queries to hide fraudulent administrator accounts from the user list, making the compromise even harder to spot.

A modus operandi already seen

Wordfence researchers indicate that the command-and-control (C2) infrastructure used in these attacks points towards the same actor behind recent supply chain compromises affecting Advanced Responsive Video Embedder and OptinMonster. After analyzing the available logs, the researchers believe the campaign may have begun as early as June 23, 2026.

Measures taken and current status

The affected plugins were removed from the WordPress.org directory on August 8, 2026, pending an investigation. Two poisoned API endpoints now return clean JSON data. The vulnerability has been rated with a severity of “medium” and, according to Defiant's report, remained unfixed at the time of publication.

At the time of writing, BdThemes has issued no official statement on its site. BleepingComputer has contacted the publisher for comment, with no response to date.

Recommendations for WordPress administrators

If you are using any of the mentioned BdThemes plugins, it is recommended to:

  • Immediately disable the affected plugins pending an official fix;
  • Check the list of administrator users via a direct database query (bypassing WordPress masking) to detect any fraudulent accounts;
  • Search for the presence of emer-run.php files or recently installed fake plugins;
  • Consider using a WAF like Wordfence to block XSS exploitation attempts;
  • Monitor access logs for any suspicious activity dating back to late June 2026.

This incident once again reminds us that the security of a WordPress site does not only depend on the code installed locally, but also on the entire supply chain — including the remote API feeds that plugins silently query in the background.