BdThemes WordPress Plugin Supply-Chain Compromise Used to Create Hidden Admin Accounts

A compromise of infrastructure used by WordPress developer BdThemes allowed attackers to tamper with a remote data feed and target administrator sessions on websites using the company’s plugins.

Security researchers at Defiant, the company behind Wordfence, said they began observing attacks on August 7. The affected plugins were subsequently removed from the WordPress.org directory while the WordPress Plugins team investigates. BdThemes products include Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery and Ultimate Store Kit. Element Pack alone lists more than 100,000 active installations, while BdThemes promotes a portfolio exceeding 350,000 installs.

Poisoned promotional feed

The attack reportedly involved write access to a vendor-controlled storage bucket. The intruder altered a JSON feed used to display promotional banners inside WordPress administration pages. A cross-site scripting weakness in BdThemes’ Biggop Library failed to properly escape data received from the company’s API, allowing malicious JavaScript to be delivered through the otherwise legitimate feed.

According to Defiant, the vulnerable parsing code was introduced in March 2026. The issue affects the Biggopti component, which retrieves and displays the promotional content. Researchers assigned the vulnerability a medium severity rating and said it remained unpatched when their report was published.

Stealthy account creation and persistence

When a logged-in administrator opened a WordPress dashboard page, the injected script could use that authenticated session to create additional administrator accounts. The code also altered database queries to hide those accounts from normal user listings, potentially delaying discovery.

A second payload, identified as w2.js, allegedly installed a fake plugin containing a webshell named emer-run.php. This provided attackers with a mechanism for maintaining access after the initial account creation.

Because the malicious content was served through an API response, the attack did not require a plugin update, direct file modification or administrator interaction beyond visiting an affected dashboard page. Researchers linked the observed command-and-control infrastructure to an actor previously associated with supply-chain incidents involving Advanced Responsive Video Embedder and OptinMonster.

Defiant’s review indicated that activity may have begun as early as June 23. BdThemes had not published a public statement at the time of reporting. Website owners using the affected products should review administrator accounts, installed plugins and server files, and monitor for signs of unauthorized access.