Security analysts at Wordfence have uncovered a supply chain breach involving seven widely used WordPress plugins, developed by BdThemes.
Rather than tampering with the actual plugin code, perpetrators targeted an external JSON data feed to weaponize an XSS flaw residing inside the Biggopti promotional banner feature. By manipulating a DigitalOcean Spaces bucket that fed API responses, the hackers circumvented conventional defenses entirely, making standard plugin updates unnecessary for the exploit to succeed.
The root cause dates back to March 2026, when BdThemes implemented inadequate client-side escaping within their JSON parsing routines. Investigators located the security gap inside the “display_id” parameter of the Sigmative API. Once the threat actors gained unauthorized write privileges to the storage container, they embedded malicious JavaScript payload data into the promotional JSON files. Consequently, any authenticated administrator loading a wp-admin dashboard would trigger the exploit automatically.
Upon execution, the script reached out to a command-and-control server located at “ia-cdn.com” to retrieve directives. It then leveraged the WordPress REST API to manufacture unauthorized administrator accounts and fetched a malicious archive named “wp-smart-thumbnails,” which contained the “emer-run.php” web shell.
To maintain access, the malware dropped persistence mechanisms into the Must-Use plugins folder, including a magic-login backdoor permitting unauthenticated admin entry simply by passing specific URL parameters.
Affected Plugins
- Element Pack Addons for Elementor(bdthemes-element-pack-lite)
- Prime Slider Addons for Elementor(bdthemes-prime-slider-lite)
- Pixel Gallery Addons for Elementor(pixel-gallery)
- Ultimate Post Kit Addons for Elementor(ultimate-post-kit)
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor(ultimate-store-kit)
- Live Copy Paste for Elementor (live-copy-paste)
- Smart Admin Assistant (smart-admin-assistant)
External Resources
- Primary Payload URL: ia-cdn[.]com/fz/w2.js
- C2 Beacon Endpoint: ia-cdn[.]com/fz/c
- Poisoned Vendor API Endpoints (now cleaned):
- api[.]sigmative[.]io/prod/store/api/biggopti/api-data-all-records
- api[.]sigmative[.]io/prod/store/api/biggopti/api-data-records
- api[.]sigmative[.]io/prod/store/api/biggopti/x.js
Filesystem & Database
- Webshell File: emer-run.php (md5: 1024732009983dd5e54b4cf5593f04d4)
- MU-Plugin Magic Login Backdoor: class-wp-token-validate.php (md5: 7719cd98a35ffad2771f26d1ceab7d27)
- MU-Plugin Stealth Module: class-wp-query-9d127ff3.php (or similar class-wp-query-*.php naming. md5: 9aadc3e5c5242b273bd17c5bdc358845)
- MU-Plugin “Health Check” Module: wp-cache-optimizer.php (md5: e450ae5bc4bfc0d960dded06a76bb8e9)
- Database option: fz_emer_login_tokens (Stores magic login tokens)
- Database option: fz_emer_done_v1 (Flag indicating completed compromise)
- Accounts utilizing @wordpress.org or @developer.wordpress.org domains.
- Usernames matching bd_ + 6 alphanumeric characters.
In parallel, the attackers utilized an alternative payload driven by deterministic credentials calculated straight from the target site’s hostname. This generation scheme produced predictable accounts starting with “bd_” alongside passwords constructed from “Bd@26!” combined with computed hashes. Such a method let the operators access compromised environments without keeping a centralized database of infected hosts.
Wordfence connected this command-and-control infrastructure to earlier WordPress supply chain incidents involving OptinMonster and the Advanced Responsive Video Embedder.
“Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository,” Wordfence researcher Paolo Tresso said. “Instead, threat actors poisoned a static remote JSON data stream fetched by an administrative promotional banner component.”
This overlap points toward a broader, synchronized campaign designed to plant enduring backdoors throughout the WordPress ecosystem. Furthermore, because the malicious JSON payloads were uploaded straight to BdThemes’ own infrastructure, investigators suspect a major breach of the vendor’s internal cloud credentials or administrative systems.
The impacted extensions (consisting of Element Pack Addons, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant) were pulled from the official WordPress.org directory on August 7 and 8.
Website managers need to review their user lists right away for accounts bearing “@wordpress.org” addresses or usernames beginning with “bd_.”
Because standard plugin updates only strip away primary plugin files while leaving server-side modifications untouched, manually scrubbing the Must-Use plugins directory is also required.
