Summary
- Wordfence says attackers poisoned a remote JSON feed consumed by a component bundled with seven BdThemes plugins.
- Malicious code could create rogue administrator accounts, install a web shell, and establish hidden persistence when an administrator opened WordPress.
- The compromise bypassed the normal plugin-update path, exposing a software supply-chain dependency outside the code distributed through WordPress.org.
A compromise affecting seven BdThemes WordPress plugins has shown how malicious code can enter an administration environment without attackers modifying the plugin files distributed through the official WordPress repository.
BdThemes plugins used an internal component to retrieve promotional banner data from a remote JSON feed. Wordfence Threat Intelligence said attackers gained the ability to replace content in that upstream feed, exploiting insufficient output escaping in the component so malicious JavaScript executed when a logged-in administrator loaded WordPress administration pages.
Wordfence was notified of the incident on 7 August and said the affected plugins were temporarily closed in the WordPress plugin directory while the WordPress Plugins team investigated. The affected products include Element Pack Addons for Elementor, Live Copy Paste for Elementor, Pixel Gallery Addons for Elementor, Prime Slider Addons for Elementor, Smart Admin Assistant, Ultimate Post Kit Addons for Elementor, and Ultimate Store Kit.
The compromise is significant because the malicious behaviour did not depend on a poisoned plugin update. Wordfence said no source-code files in the official WordPress.org repository were modified. Instead, a component already installed on websites continued retrieving remote promotional data, and the trusted response from that external infrastructure became the delivery mechanism.
Once executed in the context of a logged-in administrator, the malicious JavaScript could use the privileges of that browser session to create an additional administrator account. Wordfence also observed payloads that installed a fake plugin containing a PHP web shell and then established further persistence through WordPress must-use plugins. Separate code could hide malicious accounts from normal administrative views.
That turns what appears superficially to be a medium-severity cross-site scripting weakness into a broader supply-chain problem. Exploitation required control of the upstream feed, but once that condition existed, each site loading the compromised response became a potential downstream target. The weakness was therefore not only in how data was rendered but in the trust relationship between installed software and an external service allowed to influence privileged administration pages.
Remote content is common across modern software. Applications retrieve feature flags, templates, advertising, analytics, update metadata, help content, and configuration from services that sit outside the signed or reviewed code package. Those connections can reduce the assurance gained from inspecting a repository or validating an update because behaviour can still be affected by data returned at runtime.
The BdThemes incident also highlights the privilege of the browser inside administrative interfaces. A request that merely renders a banner may appear peripheral to the core security of a content-management system. If that data is inserted into a privileged page without sufficient escaping, however, code can inherit the authority of an authenticated administrator and use legitimate WordPress functions to create accounts or install software.
Wordfence linked infrastructure associated with the campaign to threat activity seen in other recent WordPress supply-chain incidents, although attribution to a named operator has not been established. The researchers said the upstream compromise indicates that attackers obtained a route to modify material hosted in BdThemes’ infrastructure or associated cloud storage.
The incident leaves affected site owners with a different recovery problem from a normal vulnerable-plugin update. Installing clean code is not enough if an attacker already created administrative users, deployed web shells, or established persistence elsewhere on the server. The relevant question becomes whether the site consumed the malicious feed while a privileged administrator was active and whether downstream changes were made before the infrastructure was secured.
For software vendors, the episode expands the definition of the supply chain beyond repositories and build systems. Any remotely controlled content that reaches a privileged interface can become part of the executable trust path, even when the signed package itself remains untouched.
