BdThemes Supply Chain Attack Creates Rogue WordPress Admins

A BdThemes supply chain attack compromised upstream infrastructure at the WordPress plugin vendor. The attacker never touched code in the WordPress.org repository. Instead, they altered a remote data feed that BdThemes plugins fetch and display inside the wp-admin dashboard.

Wordfence, the threat intelligence team at security firm Defiant, began seeing exploitation attempts through its web application firewall on August 7, 2026. The team traced the cause to a cross-site scripting flaw that turned a routine promotional banner into a script running inside logged-in administrators’ sessions.

For security teams, the incident shows WordPress supply chain risk extends past plugin code. A vendor-controlled API response can become an attack vector even when plugin files never change.

How a promotional banner turned into an attack vector

Biggopti is the BdThemes component behind the poisoned feed. It pulls promotional banner data from a vendor-controlled API and renders it inside wp-admin using the Biggop Library, the underlying script where the display_id escaping flaw actually lives.

Wordfence reported that the attacker gained write access to the storage bucket behind that API and used it to swap in a malicious JSON response. The substitution alone was enough to trigger script execution, since Biggopti rendered the payload without properly escaping it.

Wordfence traced the underlying coding flaw back to March 2026, when BdThemes introduced the vulnerable parsing logic. The bug had existed for months. The attacker’s real work was gaining access to infrastructure the vendor already controlled, not finding a new flaw.

From poisoned feed to rogue admin account

Once the malicious JSON reached a customer’s site, the attack chain ran automatically. It required no action from the administrator beyond opening a normal wp-admin page.

• A logged-in administrator opens any wp-admin page, and Biggopti fetches the promotional banner data as usual.
• Security researchers reported that the poisoned display_id field broke out of its intended HTML attribute, executing injected script in the administrator’s browser.
• The script uses that authenticated session to silently create a new WordPress administrator account.
• A secondary payload installs a disguised plugin containing a web shell, reported as emer-run.php, to preserve access.
• The injected code manipulates database queries so the rogue account does not appear in the standard WordPress user list.

Because the payload lived in the API response rather than in plugin files, it executed every time an administrator loaded the dashboard. No plugin update or local file change occurred on the victim’s site.

BdThemes supply chain attack: Stage-by-stage overview

Signs of compromise on affected sites

Public reporting on the incident points to a small set of concrete artifacts worth checking, even after the poisoned API endpoints were cleaned:

• Unfamiliar administrator accounts, including ones not visible through the standard Users screen.
• A file named emer-run.php, reported as the disguised web shell’s location.
• Some security outlets reported an unexpected Must-Use plugin appearing in the mu-plugins directory.
• Unusual database query behavior, consistent with the account-hiding mechanism reported.

WordPress.org pulled Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit from its directory on August 8, 2026, pending review. Additional security reporting identified two further affected plugins, Live Copy Paste and Smart Admin Assistant. The two poisoned API endpoints now return clean data, according to reporting on the incident. Defiant’s report described the underlying escaping flaw in the Biggop Library as unpatched at the time of publication.

Why this matters beyond WordPress patching

Most WordPress supply chain incidents involve a compromised update package or a backdoored file. Here’s what set this one apart:

• The unescaped parsing flaw resided in the local plugin, but the malicious payload was delivered dynamically via the vendor’s remote API.
• A site running an unmodified, correctly installed copy of an affected plugin was still exposed, since the compromise arrived through a channel outside the plugin’s release process.
• Reviewing installed plugin versions alone would not have surfaced this risk.
• Wordfence linked the attack’s command-and-control infrastructure to the group behind the Advanced Responsive Video Embedder and OptinMonster incidents.
• The shared infrastructure suggests the same actor may be targeting vendor-side systems across multiple WordPress plugin ecosystems, rather than individual customer sites.

Featured resource

Securing the Supply Chain Sector: A Comprehensive Report

Close cybersecurity readiness gaps, close skill shortages, and manage third-party vendor risk today.

DOWNLOAD

Where Hexnode endpoint controls reduce this kind of risk

The BdThemes supply chain attack falls outside what Hexnode monitors directly. Hexnode doesn’t monitor WordPress application logs, detect this specific vulnerability, or patch third-party plugin code.

Remediation of the Biggop Library flaw depends on BdThemes and the WordPress Plugins team. This attack ran inside the browser and on the vendor’s and victim’s servers, so it would not have appeared as endpoint-level activity in the first place.

Hexnode UEM

• Hexnode UEM enforces operating system and application patch compliance across Windows, macOS, and Linux, covering the devices administrators use to manage WordPress sites.
• It feeds compliance data to Entra ID Conditional Access, currently scoped to Android, iOS, and macOS, to gate access to Entra ID–connected corporate resources. That gating would only apply to a WordPress admin portal if the organization publishes it separately through Entra ID.

Hexnode XDR

• Hexnode XDR complements Hexnode UEM as an endpoint security layer, primarily for Windows and macOS environments.
• It detects and flags security threats on Windows endpoints, correlating alerts by severity so IT teams can prioritize investigation.
• It also enables administrators to kill a malicious process, quarantine infected files, or isolate a compromised endpoint once a threat is flagged.

None of this replaces vendor remediation or a direct review of the WordPress installation itself. This attack’s own execution path, browser script to server-side account creation, sits outside what endpoint detection tools observe. Hexnode’s role here is general endpoint hygiene, not detection of this specific attack chain.

Conclusion

The BdThemes supply chain attack shows that WordPress supply chain risk isn’t confined to plugin updates. A routine data feed from an already-trusted vendor was enough to hijack administrator sessions and plant lasting access, with no code change on the victim’s site.

Security teams managing WordPress environments should treat vendor-fed dashboard content as part of their exposure surface, not just plugin code and update channels. Auditing administrator accounts, checking for the reported web shell artifacts, and hardening the endpoints administrators use to manage these sites all help. Together, they reduce the chance that the next poisoned feed goes unnoticed.