**BdThemes**, a well-known provider of WordPress plugins such as **Element Pack**, **Prime Slider**, and **Ultimate Post Kit**, has fallen victim to a supply chain attack. The attack, first detected on August 7, involved the compromise of **BdThemes**' upstream infrastructure, allowing threat actors to manipulate a remote JSON feed. ### How the Attack Unfolded The attackers gained write access to the vendor's storage bucket and subsequently poisoned a static remote JSON data stream. This stream is typically fetched by an administrative promotional banner component within the plugins. According to security firm **Defiant**, which operates the **Wordfence** web application firewall (WAF), a cross-site scripting (XSS) vulnerability in the JSON response parsing code was exploited. The flaw, introduced in March 2026, resides in the **Biggop Library**, used by the **Biggopti** component. This component is responsible for retrieving promotional banners from the vendor's API server and displaying them in the WordPress admin dashboard. ### Stealthy Compromise and Persistence The malicious JavaScript injection leveraged the legitimate administrator’s authenticated session to create unauthorized admin accounts on compromised sites. Further, an additional payload (`w2.js`) established persistence through a webshell (`emer-run.php`) by installing a fake plugin. **Wordfence** researchers noted, "The **Biggop Library** is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the **Sigmative API** in various versions due to insufficient output escaping." This vulnerability enabled attackers to inject arbitrary web scripts that would execute whenever a user accessed an injected page.  **The malicious API response** *Source: Wordfence* Crucially, the attack is entirely API-driven, requiring no user interaction, file modification, or plugin updates. The payload executes silently every time a logged-in administrator opens a `wp-admin` page. To evade detection, the injected code manipulates WordPress database queries to hide the rogue administrator accounts from the user list. ### Broader Campaign and Current Status **Wordfence** researchers suggest that the command-and-control (C2) infrastructure used in these attacks points to the same actor behind recent supply chain compromises involving **Advanced Responsive Video Embedder** and **OptinMonster** plugins. Analysis indicates the campaign may have started as early as June 23. As of August 8, the affected **BdThemes** plugins have been pulled from the WordPress.org directory pending a full review. The poisoned API endpoints now return clean JSON data. **BdThemes** has yet to release an official statement regarding the incident.