BdThemes, a developer of premium WordPress web-design tools, has experienced a supply-chain compromise that led to the creation of unauthorized administrator accounts on customer websites. The incident, which began as early as June 23, involved a threat actor modifying a remote JSON feed to inject malicious code into WordPress admin dashboards.
The attack specifically targeted the Biggop Library, utilized by the Biggopti component within BdThemes plugins. This component is responsible for fetching promotional banners from the vendor's API server and displaying them in the WordPress admin dashboard. Researchers at the security firm Defiant identified a cross-site scripting (XSS) vulnerability in the JSON response parsing code, introduced in March 2026. This flaw, present in various versions of the Biggop Library, allowed an attacker who compromised the Sigmative API server to inject arbitrary web scripts due to insufficient output escaping in the `display_id` parameter.
The threat actor gained write access to BdThemes' storage bucket, enabling them to poison a static remote JSON data stream. When a logged-in administrator accessed a WordPress admin page, the malicious JavaScript executed within their authenticated session. This script then created rogue administrator accounts on the affected sites. To maintain persistence, an additional payload, `w2.js`, installed a fake plugin and established a webshell named `emer-run.php`. The injected code also manipulated WordPress database queries to conceal these rogue accounts from the user list, making detection more challenging.
Defiant's Wordfence web application firewall began detecting these attacks on August 7. The firm noted that the attack is entirely API-driven, requiring no user interaction, file modification, or plugin updates, making it particularly stealthy.
BdThemes' product portfolio includes popular plugins such as Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. The free Element Pack plugin alone has over 100,000 active installations on WordPress.org, and the developer advertises a total of over 350,000 active installs across its offerings.
Following the discovery of the attacks, all affected BdThemes products were removed from the WordPress.org directory on August 8, pending a comprehensive review by the WordPress Plugins team. As of August 10, the two poisoned API endpoints were reportedly returning clean JSON data.
Defiant researchers have indicated that the command-and-control (C2) infrastructure used in these attacks appears to be linked to the same threat actor responsible for recent supply-chain compromises affecting the Advanced Responsive Video Embedder and OptinMonster plugins.
As of the latest reports, BdThemes has not released an official statement regarding the incident on its website. The XSS vulnerability in the Biggop Library remains unpatched, according to Defiant's report, which assigned it a medium severity score.
