BdThemes Plugin Compromise: WordPress Supply Chain Attack

BdThemes, a developer of premium WordPress plugins, fell victim to a supply chain attack after hackers gained control of its infrastructure and injected malicious code into a remote JSON feed loaded in WordPress admin panels. This resulted in the automatic creation of hidden admin accounts with elevated privileges on vulnerable sites.

Security researchers at Defiant discovered the attack on August 7. According to their findings, hackers exploited an XSS vulnerability in the Biggop Library, which handles JSON responses from BdThemes' API. Insufficient filtering of the *display_id* parameter allowed arbitrary JavaScript code to execute each time a WordPress admin panel was opened.

The malicious code masked the created accounts by altering WordPress database queries, making the compromise nearly undetectable to site owners. Experts note that the attack required no user interaction and left no traces in the file system. The WordPress.org team temporarily removed all BdThemes plugins from its repository for security review.

Defiant reports the attack began no later than June 23. While two vulnerable API endpoints now return clean data, BdThemes has not yet issued an official statement. Experts link this attack to the same threat actors behind previous compromises of Advanced Responsive Video Embedder and OptinMonster plugins.