BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have uncovered a supply chain attack targeting WordPress plugin vendor BdThemes, leading to the temporary suspension of several plugins from the WordPress.org repository. Unlike traditional supply chain attacks, no source code files were modified; instead, threat actors poisoned a static remote JSON data stream fetched by an administrative promotional banner component.

The affected plugins include Element Pack Addons for Elementor (100,000+ active installs), Live Copy Paste for Elementor (6,000+ active installs), Pixel Gallery Addons for Elementor, Prime Slider Addons for Elementor, Smart Admin Assistant, Ultimate Post Kit Addons for Elementor, and Ultimate Store Kit (6,000+ active installs). The plugins were closed for download pending a full review.

The attack exploited a cross-site scripting (XSS) vulnerability in the Biggopti component, which fetches promotional banners from an API server and renders them in the WordPress admin dashboard. The flaw, rated 5.4 on the CVSS scale, allowed attackers who compromised the API to inject arbitrary web scripts that executed on every wp-admin page load, silently activating in the browsers of logged-in administrators.

The attack was first introduced on March 1, 2026, in the bdthemes-prime-slider-lite plugin. Threat actors gained write access to a DigitalOcean Spaces bucket, replacing legitimate JSON responses with crafted payloads. The main payload, a JavaScript file named w2.js, contacted a command-and-control (C2) server, created rogue administrator accounts via the WordPress REST API, installed a fake plugin containing a PHP web shell, and deployed persistence modules including a magic-login backdoor and an anti-analysis stealth module.

An alternate payload, x.js, generated deterministic administrative credentials derived from the victim website’s hostname, allowing attackers to maintain covert access without storing compromised site lists. The C2 server is linked to previous supply chain attacks involving Advanced Responsive Video Embedder (CVE-2026-18072) and OptinMonster, indicating a broader campaign aimed at establishing covert administrative persistence and remote code execution across WordPress environments.

This incident follows WordPress’s recent patch of a pre-authentication reflected XSS flaw (CVE-2026-64638, CVSS 8.9) that could lead to PHP code execution.