August 10, 2026 — The WordPress ecosystem has just been hit by a highly sophisticated malware campaign. In what researchers are calling the BdThemes WordPress supply chain attack 2026, threat actors successfully bypassed standard code repositories to inject persistent backdoors into thousands of live websites.
Unlike traditional plugin hacks, the attackers did not modify the source code stored in the official WordPress.org repository. Instead, they compromised a trusted remote promotional API feed that seven popular BdThemes plugins rely on to fetch dashboard banners.
This incident proves that even if a site administrator updates their plugins directly from secure servers, relying on third-party remote data streams can still lead to complete account takeover and webshell deployment.
(Is your WordPress site secure? Read our guide on fixing the recent WP2Shell WordPress Vulnerability.)
How Did the BdThemes API Poisoning Attack Work?
The BdThemes WordPress supply chain attack 2026 worked by exploiting a Cross-Site Scripting (XSS) vulnerability within an internal plugin component named Biggopti. Attackers hijacked a static JSON data stream hosted in a DigitalOcean Spaces bucket, replacing legitimate banner data with a malicious display_id payload.
Because the Biggopti component failed to properly escape this display_id value before inserting it into an HTML attribute, the malicious script triggered automatically whenever a logged-in administrator opened any wp-admin dashboard page.
The payload utilized a highly stealthy onanimationstart event handler hidden inside the injected HTML attribute. This allowed the script to execute silently in milliseconds without requiring the administrator to click any suspicious links.
Which WordPress Plugins Are Affected by the Breach?
The supply chain compromise impacts seven popular plugins developed by BdThemes, all of which utilize the vulnerable Biggopti promotional banner component.
According to Wordfence Threat Intelligence (who discovered the incident on August 7, 2026), the malicious campaign may have started as early as June 23. The WordPress Plugins team has temporarily closed these plugins in the official directory pending a full security review. The affected plugins include:
- Element Pack Addons for Elementor
- Prime Slider Addons for Elementor
- Pixel Gallery Addons for Elementor
- Ultimate Post Kit
- Ultimate Store Kit
- Live Copy Paste
- Smart Admin Assistant
What Malware Was Deployed on Compromised Sites?
Once the poisoned XSS payload executed in the administrator’s browser, it immediately fetched secondary malware from an attacker-controlled command-and-control (C2) server at ia-cdn[.]com/fz/c. This script then used the active administrator’s WordPress nonce to hijack the site.
The malware executed a multi-stage persistence strategy. First, it created rogue administrator accounts (often using usernames starting with bd_ and ending with @wordpress.org emails). Second, it installed a fake, harmless-looking plugin (like wp-smart-thumbnails) containing a dangerous webshell named emer-run.php.
Finally, the attackers deployed Must-Use (MU) plugins to manipulate WordPress database queries, hiding their rogue admin accounts from the normal user list and altering user totals to evade detection.
Indicators of Compromise (IoC) & Threat Intelligence Table
To detect if your system was affected by the BdThemes WordPress supply chain attack 2026, network administrators must urgently scan their environments for the following Indicators of Compromise (IoCs).
| Threat Artifact | Type | Description / Path |
|---|---|---|
| ia-cdn[.]com/fz/c | C2 Domain | Primary command-and-control server serving w2.js payloads. |
| w2.js | Primary Payload | First-stage script contacting C2 to determine if the site should be targeted. |
| x.js | Secondary Payload | Generates predictable admin credentials derived from the victim site’s hostname. |
| emer-run.php | Webshell | Backdoor allowing direct unauthenticated remote code execution. |
| wp-smart-thumbnails | Fake Plugin | Deceptive plugin directory used to house the malicious webshell. |
| class-wp-query-* | Must-Use (MU) Plugin | Suspicious files hiding rogue admin accounts from user lists. |
| fz_emer_login_tokens | Database Option | Magic-login backdoor parameter injected into the wp_options table. |
| bd_[6-char-hash] | Rogue Admin | Unauthorized admin accounts, frequently paired with @wordpress.org emails. |
(For a complete framework on securing networks against persistent threats, reference the CISA Known Exploited Vulnerabilities Catalog.)
Frequently Asked Questions
What is the BdThemes WordPress supply chain attack 2026?
The BdThemes WordPress supply chain attack 2026 is a massive cybersecurity incident where hackers compromised a remote API feed used by seven popular BdThemes plugins. The poisoned feed injected malicious JavaScript (XSS) into WordPress admin dashboards, allowing attackers to deploy webshells and hijack websites.
Which BdThemes plugins were compromised in the attack?
Seven plugins were impacted due to their reliance on the vulnerable Biggopti component: Element Pack Addons, Prime Slider Addons, Pixel Gallery Addons, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant.
How can I fix my WordPress site if I use BdThemes plugins?
Site administrators must urgently audit their user lists for rogue accounts (usernames starting with bd_), check the Must-Use plugins directory for suspicious ‘class-wp-query-*’ files, and scan the filesystem for the ’emer-run.php’ webshell or ‘wp-smart-thumbnails’ fake plugin.
