NewsPublished 10 Aug 2026

BdThemes plugins supply-chain hack creates rogue WordPress admins

Source Bleeping Computer

Description

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. [...]

Impact

The attack enables unauthorized creation of rogue administrator accounts on affected WordPress sites, granting attackers full administrative control. These rogue accounts are hidden from the user list, making detection difficult. The attacker also establishes persistence via a webshell installed as a fake plugin, allowing ongoing remote control. The attack is stealthy, requires no file modification or plugin update, and executes whenever an admin accesses the dashboard, increasing the risk of widespread compromise of sites using affected BdThemes plugins.

Defensive guidance

The affected plugins have been removed from the WordPress repository pending investigation, and the malicious API endpoints have been cleaned to serve legitimate JSON data. Site administrators should remove affected BdThemes plugins and monitor for unauthorized admin accounts and suspicious files such as emer-run.php. Until an official fix is released, avoid using BdThemes plugins and follow updates from the vendor and WordPress security teams for remediation guidance.

Summary

The BdThemes supply-chain attack involved a threat actor gaining write access to the vendor's storage bucket and poisoning a static remote JSON data stream fetched by an administrative promotional banner component in BdThemes WordPress plugins. A coding flaw introduced in March 2026 created a cross-site scripting (XSS) vulnerability in the Biggop Library's JSON response parsing, specifically via the 'display_id' parameter from the Sigmative API. This allowed injection of arbitrary JavaScript that executes in the WordPress admin dashboard whenever an administrator accesses it. The malicious script creates rogue admin accounts that are hidden from the user list and installs a webshell (emer-run.php) through a fake plugin for persistence. The attack is stealthy, API-driven, requires no user interaction or plugin update, and was active from at least June 23 until the plugins were pulled on August 8, 2026. The vendor has not yet issued an official statement or patch, but the poisoned API endpoints now serve clean JSON data.

References

bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Aug 2026, 21:22 UTC

References

Community reviews

Related threats