Seven WordPress plugins developed by BdThemes, a vendor of Elementor add-ons, were exploited to inject rogue administrator accounts and webshells onto live websites. The compromise, which did not involve modifying any plugin files, was reported on August 7 and publicly analyzed by Wordfence on August 8. All seven affected plugins, distributed through the official WordPress.org directory, have been temporarily removed for review.
The attack leveraged a vulnerability within a component called Biggopti, which is included in the BdThemes plugins. Biggopti retrieves promotional banners from the vendor's API. Attackers gained write access to the object storage bucket backing this API, enabling them to replace legitimate API responses with malicious payloads.
Wordfence traced the vulnerability to a script added to the Prime Slider plugin on March 1. This script concatenated a field from the remote JSON response directly into an HTML attribute without proper escaping. While a neighboring attribute in the same code was correctly escaped, suggesting an oversight rather than intentional design, a sanitizer introduced in May failed to address the flawed attribute. The script executes whenever an administrator loads a `wp-admin` page, allowing the injected code to run silently in the administrator's browser. The vulnerability has a reported severity rating of 5.4 (medium) and remains unpatched.
The initial payload exploited the administrator's active session token to create a new administrator account via the WordPress REST API. Subsequently, a fake plugin containing a webshell was installed. This webshell deployed two persistence modules: one that granted unauthenticated administrative access through a URL parameter, and another that hooked into database queries to conceal the rogue accounts from the user list and adjust user counts to match. A secondary payload, hosted on BdThemes' own infrastructure, derived administrator credentials from the victim's hostname, providing a specific indicator for incident responders.
Wordfence identified the command and control (C2) domain used in this attack as being linked to actors responsible for recent compromises involving the Advanced Responsive Video Embedder and OptinMonster plugins. The presence of a payload within the vendor's own storage bucket suggests a significant upstream compromise of BdThemes' infrastructure. Both malicious endpoints were reportedly cleaned by August 8.
Given that no plugin files were altered, Wordfence advises site owners to meticulously audit their database user lists, plugin directories, and the options table for any signs of compromise.
