BdThemes Supply Chain Attack Poisons JSON API to Inject WordPress Web Shells

A sophisticated BdThemes supply chain attack has forced the WordPress plugins team to temporarily pull multiple popular plugins from the official directory after attackers compromised the vendor’s cloud storage infrastructure. Rather than tampering with source code stored in the official repository, threat actors poisoned a remote JSON data stream fetched by an administrative promotional banner module embedded across BdThemes’ software ecosystem.

The attack impacts widely deployed add-ons, including Element Pack Addons for Elementor (over 100,000 active installations), Live Copy Paste for Elementor (6,000+ active installs), Ultimate Store Kit (6,000+ active installs), Prime Slider Addons, Pixel Gallery Addons, Smart Admin Assistant, and Ultimate Post Kit Addons. On August 7 and 8, 2026, WordPress closed the listings for these plugins, disabling new downloads pending a full security review.

How the JSON Data Poisoning Works

The underlying attack vector relies on an internal administrative component named Biggopti, which is shipped alongside BdThemes plugins. Biggopti is designed to pull promotional banners from the Sigmative API server and render them inside the wp-admin dashboard by fetching static JSON files stored in a DigitalOcean Spaces cloud storage bucket.

The library contained a client-side cross-site scripting (XSS) vulnerability rated at CVSS 5.4. Specifically, the JSON response parsing logic failed to perform sufficient client-side escaping on the display_id parameter fetched from the API. Threat actors obtained write access to BdThemes’ DigitalOcean bucket and replaced legitimate JSON files with malicious payloads.

Because the Biggopti library runs on every wp-admin page load, the poisoned JSON payload executes arbitrary JavaScript inside the web browser of any logged-in WordPress administrator who views an administrative page. Because this exploit relies entirely on dynamic remote content delivery, no plugin updates or local file modifications were required on the target site to trigger the initial execution. Historical analysis indicates that the modified library was first introduced into bdthemes-prime-slider-lite as early as March 1, 2026, before being rolled out across the vendor’s wider product portfolio.

Execution Flow: Backdoors, Web Shells, and Stealth

When an administrator logs in, the XSS payload triggers one of two primary JavaScript payloads depending on the API endpoint used:

1. Main Payload (w2.js)

Delivered via the api-data-all-records endpoint, w2.js initiates a multi-stage compromise:

• C2 Check-in: The script connects to a command-and-control (C2) server at ia-cdn[.]com/fz/c, transmitting the victim site’s domain. If the server returns a “skip” or “done” status, execution stops.
• Rogue Admin Account Creation: The script leverages the WordPress REST API directly within the authenticated administrator’s browser session to silently create a new user account with administrative privileges.
• Web Shell Installation: Using standard WordPress admin plugin upload functionality, the script uploads a zip archive containing a PHP web shell (emer-run.php).
• Persistence via Mu-Plugins: The web shell drops two persistent modules into the site’s wp-content/mu-plugins (Must-Use plugins) directory. The first is a “magic-login backdoor” that targets the site’s oldest registered administrator account and allows unauthenticated admin access whenever a specific URL parameter (?_wplogin=<token>) is supplied. The second is an anti-analysis module that hooks directly into WordPress database queries to hide the rogue administrator accounts from the user management screen and alter the site’s displayed user count.

2. Deterministic Credential Payload (x.js)

Served via the api-data-records endpoint from BdThemes’ host infrastructure, x.js utilizes an algorithmic approach to generate predictable administrative credentials derived from the victim’s domain name:

• Username Format: bd_ followed by a 6-character base36 hash of the site’s hostname.
• Password Format: Bd@26! followed by the base36 hash and ending with x.
• Email Format: Formatted using an @wordpress.org suffix.

By using a deterministic generation algorithm, the threat actors do not need to maintain a centralized list of stolen credentials—they can compute the access details on demand for any infected domain. Conversely, this design flaw allows incident responders to calculate the exact username and password combinations associated with their domain to audit logs and user tables.

Shared Infrastructure and Campaign Context

The command-and-control domain ia-cdn[.]com links this campaign directly to recent software supply chain attacks targeting other popular WordPress plugins, including Advanced Responsive Video Embedder (CVE-2026-18072) and OptinMonster. In those incidents, attackers similarly established persistent administrative backdoors and hidden web shells that activated exclusively when site administrators authenticated.

The compromise of BdThemes’ internal cloud assets highlights a growing trend among threat actors: targeting cloud-hosted dynamic assets and endpoints rather than altering signed plugin source code hosted on official repositories.

Incident Response and Threat Hunting Steps

If your environment utilizes any impacted BdThemes plugins, execute the following containment and hunting steps immediately:

1. Check for Unsanitized Mu-Plugins: Inspect wp-content/mu-plugins/ for recently added PHP files that hook into database user queries or parse the ?_wplogin= parameter. Standard WordPress installations do not populate this directory by default unless specifically configured by an administrator.
2. Audit Filesystem for Web Shells: Search the wp-content/plugins/ directory for unauthorized plugins containing emer-run.php or unusual PHP scripts capable of arbitrary execution.
3. Compute and Hunt Deterministic Credentials: Compute the base36 hash of your site’s primary domain name. Check your database (wp_users table) directly via CLI or SQL client (bypassing the WordPress dashboard UI) for account names starting with bd_ or emails ending in @wordpress.org.
4. Network and Log Monitoring: Block network traffic to ia-cdn[.]com at the perimeter or web application firewall (WAF) layer, and review web server access logs for incoming POST requests to emer-run.php or GET requests containing _wplogin.
5. Restrict Dynamic Remote Assets: Where possible, restrict plugins from loading external, unvalidated administrative JSON streams, and ensure third-party developer cloud access keys are scoped with strict least-privilege policies.