BdThemes Supply Chain Attack Poisons JSON to Create Rogue Word Press Admins
Summary: Wordfence researchers reported a supply chain compromise of WordPress plugin vendor BdThemes in which attackers gained write access to a DigitalOcean Spaces bucket and replaced legitimate promotional JSON with crafted payloads, exploiting an XSS flaw in the Biggopti component's parsing of the display_id parameter. The WordPress plugins team closed the affected plugins as of August 7 or 8, 2026, pending a full review, and the injected script runs on every wp-admin page load to create rogue administrator accounts, upload a web shell plugin, and contact a command-and-control server.
What you should know: No plugin files were modified on disk, so the compromise lives in a remote JSON feed your code review and file integrity checks would never flag. The x.js payload derives admin credentials deterministically from the site hostname (bd_ plus a 6-character base36 hash), and the same C2 server is assessed to be tied to earlier backdoors in Advanced Responsive Video Embedder and OptinMonster.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2026-18072
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026