Full Report
A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. [...]
Analysis Summary
# Morning News Roll-up August 10, 2026
## Overview
A significant supply-chain compromise has targeted the BdThemes WordPress ecosystem, utilizing a poisoned API feed to inject malicious JavaScript. This campaign enables the creation of rogue administrator accounts and the installation of persistent webshells across over 100,000 active installations.
## Top Stories
### BdThemes Supply-Chain Hack Creates Rogue WordPress Admins
- Summary: Threat actors compromised BdThemes' upstream infrastructure to poison a remote JSON feed. By exploiting a cross-site scripting (XSS) vulnerability in the Biggop Library, attackers injected malicious JavaScript that executes in administrators' browsers to create hidden admin accounts and install webshells.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/
### Persistence Established via Fake Plugins and Webshells
- Summary: The BdThemes attack involves a secondary payload (w2.js) that installs a fake plugin to house a webshell named `emer-run.php`. This allows attackers to maintain long-term access to compromised WordPress sites even if the initial API injection is resolved.
- Source: hxxps://www[.]wordfence[.]com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response/
### Infrastructure Links to Previous WordPress Supply-Chain Attacks
- Summary: Security researchers have linked the command-and-control (C2) infrastructure used in the BdThemes compromise to previous high-profile attacks targeting the OptinMonster and Advanced Responsive Video Embedder plugins, suggesting a persistent actor targeting the WordPress plugin supply chain.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/optinmonster-wordpress-plugin-hacked-in-cdn-supply-chain-attack/
***
# BdThemes Supply-Chain Compromise
A supply-chain attack involving the compromise of BdThemes' upstream storage infrastructure to deliver malicious payloads through legitimate API responses.
## Key Points
- **Upstream Compromise:** Attackers gained write access to the vendor's storage bucket to poison a static remote JSON data stream used for administrative promotional banners.
- **XSS Vulnerability:** A coding flaw in the "Biggop Library" (introduced in March 2026) failed to escape the `display_id` parameter, allowing for Cross-Site Scripting (XSS).
- **Silent Execution:** The attack is API-driven and requires no user interaction or plugin updates; it executes automatically when an admin logs into the dashboard.
- **Stealth Mechanisms:** The injected code manipulates database queries to hide the newly created rogue administrator accounts from the WordPress user interface.
- **Scale:** BdThemes products have over 350,000 active installations, including the popular Element Pack plugin.
## Threat Actors
- **Attribution:** Unknown, but linked via C2 infrastructure to the actors behind the **OptinMonster** and **Advanced Responsive Video Embedder** supply-chain attacks.
- **Motivations:** Unauthorized access, persistence, and potential site monetization or data theft.
## TTPs
- **Supply Chain Compromise:** Modification of upstream JSON feeds (T1195.002).
- **Cross-Site Scripting (XSS):** Exploiting insufficient output escaping in the Biggop Library to execute arbitrary JS.
- **Account Creation:** Programmatic creation of rogue WordPress administrator accounts (T1136.001).
- **Persistence:** Installation of a fake plugin to deploy a PHP webshell (`emer-run.php`).
- **Evasion:** Hiding rogue accounts by hooking/manipulating WordPress database queries.
## Affected Systems
- **Vendor:** BdThemes
- **Affected Components:** Biggop Library and Biggopti component.
- **Impacted Plugins:** Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.
- **Scope:** Over 100,000+ active installs for Element Pack; 350,000+ total ecosystem installs.
## Mitigations
- **Immediate Action:** Audit WordPress administrator accounts directly via the database (SQL) or command line (WP-CLI) to identify hidden accounts not visible in the GUI.
- **File Integrity:** Scan for unauthorized plugins and the presence of `emer-run.php`.
- **WAF Deployment:** Utilize a Web Application Firewall (like Wordfence) to block known malicious API responses and XSS payloads.
- **Plugin Management:** The WordPress Plugins team has temporarily closed affected BdThemes plugins; users should monitor for official patches and security advisories from the vendor.
## Conclusion
This incident represents a sophisticated supply-chain attack that bypasses traditional file-integrity monitoring by leveraging dynamic API content. The ability of the payload to hide its tracks within the WordPress dashboard makes manual detection difficult. Organizations using BdThemes products should perform an immediate forensic audit of their user tables and server files.