BdThemes Plugin Supply Chain Attack Gave Hackers Silent Admin Access on WordPress Sites

Wordfence Threat Intelligence disclosed on August 8, 2026, that seven BdThemes WordPress plugins were compromised through a poisoned API response hosted on the vendor's cloud storage, not through WordPress.org plugin files. Attackers injected malicious JSON into BdThemes' static delivery infrastructure, exploiting an unpatched DOM XSS flaw in the Biggopti library that triggered automatically when a logged-in administrator opened the WordPress dashboard. Within milliseconds, the victim's browser executed external scripts that used the active admin session to silently create a rogue administrator account, upload a web shell, and install persistent malware in the MU-plugins directory. The attack also hooked WordPress database queries to conceal the unauthorized account from the admin interface, and enabled unauthenticated login via a hidden URL parameter. Wordfence detected active exploitation on August 7, 2026, and linked the command-and-control infrastructure to earlier supply chain attacks targeting the Advanced Responsive Video Embedder and OptinMonster plugins.