A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers to create rogue admin accounts.
Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review.
BdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.
Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs.
WordPress security firm Defiant started seeing attacks through its Wordfence web application firewall (WAF) on August 7.
The researchers say that the attacker “poisoned a static remote JSON data stream fetched by an administrative promotional banner component” after obtaining write access to the vendor’s storage bucket.
According to the researchers, the plugin developer had introduced a cross-site scripting (XSS) vulnerability in the JSON response parsing code, allowing the attacker to replace the legitimate promotional JSON with malicious code that exploited the security issue.
The researchers report that the attack was enabled by a coding flaw introduced in March 2026 in the JSON response-parsing code, which created a cross-site scripting (XSS) vulnerability in the BdThemes infrastructure.
The flaw is in the Biggop Library used by the Biggopti component responsible for getting promotional banners from the vendor’s API server and showing them in the customers’ WordPress admin dashboard.
A report from Defiant explains that the malicious JavaScript injection uses the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites, while an additional payload (w2.js) establishes persistence via a webshell (emer-run.php) by installing a fake plugin.
“The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping,” Wordfence researchers say.
“This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”
Source: Wordfence
The issue was assigned a “medium” severity score, and Defiant’s report lists it as unpatched as of publishing.
Because the attack is entirely API-driven, requires no interaction, file modification, or plugin update, it is entirely stealthy, and the payload executes every time a logged-in administrator opens a wp-admin page.
The injected code manipulates WordPress database queries to hide rogue administrator accounts from the user list, making the compromise more difficult to spot.
Defiant’s Wordfence researchers say that reports that the command-and-control (C2) infrastructure used in the observed attacks points to the same attacker behind the recent Advanced Responsive Video Embedder and OptinMonster supply-chain compromises.
After discovering the attacks, the researchers analyzed available records and determined that the earliest possible start of the campaign was June 23.
The affected plugins were pulled from the WordPress.org directory on August 8, pending investigation, while two poisoned API endpoints now return clean JSON data.
At the time of writing, the vendor has not published an official statement about the incident on its website.
BleepingComputer has contacted BdThemes for a statement, but we have not received a response.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
