BdThemes Plugins Pulled from WordPress.org: The Poisoned API Attack That Left No File Fingerprints

digital interactive web development hero image

The Attack That Left No File Fingerprints

Seven BdThemes plugins were quietly pulled from the WordPress.org directory on August 7 and 8, 2026. No code was altered in the repository. That is what makes this one different from every other plugin compromise covered in the last two months.

Wordfence Threat Intelligence was notified on August 7 after discovering attackers had poisoned a remote promotional API feed used by several popular BdThemes plugins. The attack vector was Biggopti, an internal component bundled with all seven plugins to display promotional banners inside the WordPress admin dashboard. Biggopti fetches JSON from a DigitalOcean Spaces bucket controlled by BdThemes. Attackers obtained write access to that bucket and swapped legitimate JSON responses for crafted payloads designed to execute JavaScript inside any logged-in administrator’s browser.

The XSS flaw was introduced by BdThemes itself. Wordfence traced it through SVN history to March 1, 2026, when a script added to Prime Slider version 4.1.9 began concatenating a remotely supplied display_id field directly into an HTML id attribute without escaping it. A neighboring attribute in the same code block is escaped correctly. Wordfence characterizes the discrepancy as an oversight, not intent. A sanitizer added in May left the flawed attribute untouched.

What the Payload Actually Does

The injected script fires on every wp-admin page load for any logged-in administrator. No click required. No unusual navigation, no suspicious email link.

The JavaScript payload, a file named w2.js, contacts a C2 server at ia-cdn[.]com/fz/c with the victim site’s origin to fetch targeting instructions. From there the chain runs without further interaction: the script uses the administrator’s own active session token to create a new administrator account via the WordPress REST API, installs a fake plugin carrying a webshell named emer-run.php, and deploys two persistence modules. The first grants unauthenticated administrative access through a URL parameter. The second hooks database queries to hide the rogue accounts from the WordPress user list and adjusts account counts to match, making forensic identification harder inside a standard admin interface.

A second payload hosted directly on BdThemes’ own infrastructure derived administrator credentials from the victim’s hostname. Responders can compute exactly what credential format to hunt for once the hostname is known.

Scope and Affected Plugins

The seven affected plugins:

  • Element Pack Addons for Elementor — 100,000+ active installs
  • Prime Slider Addons for Elementor
  • Pixel Gallery Addons for Elementor
  • Ultimate Post Kit Addons for Elementor
  • Ultimate Store Kit for WooCommerce, EDD, and Elementor — 6,000+ active installs
  • Live Copy Paste for Elementor — 6,000+ active installs
  • Smart Admin Assistant

BdThemes claims 350,000+ active installations across its portfolio. Wordfence found timestamps in the poisoned records suggesting the campaign may have started as early as June 23, 2026, meaning sites that ran any of these plugins during that window are exposed even though the API endpoints returned clean JSON by August 8. All seven plugins remain closed on WordPress.org pending a full review. BdThemes has not published an official statement.

Connection to the Wider Campaign

Wordfence linked the ia-cdn[.]com C2 infrastructure to the same threat actors behind the Advanced Responsive Video Embedder backdoor (CVE-2026-18072) and the OptinMonster compromise, both of which surfaced in the two months prior. The end goal across all three campaigns is consistent: establish covert administrative persistence and remote code execution across WordPress environments at scale.

The direct upload of malicious JSON and JavaScript into BdThemes’ own storage bucket rather than a third-party CDN points to a serious breach of the vendor’s cloud credentials or internal infrastructure. This is not a CDN hijack. The vendor’s own upstream is what was compromised.

What to Check Right Now

If any of the seven plugins are or were active on a site at any point since late June, the investigation does not start at the plugin folder. File integrity scanning will not flag the initial compromise. The malicious content never lived in reviewed code.

Start here:

  1. Check WordPress admin accounts for usernames with bd_ prefixes or email addresses ending in @wordpress.org.
  2. Inspect wp-content/mu-plugins for unfamiliar files, particularly anything resembling emer-run.php or class-wp-query-* filenames that do not correspond to installed plugins.
  3. Query the database for the options fz_emer_login_tokens and fz_emer_done_v1.
  4. Review all plugin installation events and admin account creations going back to June 23, 2026, not just the August patch window.
  5. Treat any backup from that period as potentially containing rogue accounts or webshell files.

Wordfence Premium, Care, and Response customers received detection signatures and WAF rules on August 7. Free Wordfence users are scheduled to receive those same protections after the platform’s standard 30-day delay. If your site runs a free Wordfence tier and any of these plugins were active, manual investigation is the only available path right now.

This attack changes one operational assumption: a plugin’s safety record on WordPress.org no longer tells you anything about the safety of the remote services that plugin phones home to on every page load.

Sources: