Rogue WordPress Admins

Overview

A sophisticated supply‑chain attack has compromised the upstream infrastructure of BdThemes, a developer of premium WordPress design tools. Threat actors poisoned a remote JSON feed delivered to administrators’ browsers, exploiting a cross‑site scripting (XSS) flaw to silently create rogue WordPress admin accounts.

What Happened

• Compromised infrastructure: Attackers gained write access to BdThemes’ storage bucket.
• Poisoned JSON feed: Malicious code replaced legitimate promotional JSON data fetched by WordPress admin dashboards.
• XSS vulnerability: Introduced in March 2026 within the Biggop Library’s JSON parsing logic.
• Stealth execution: Payload executed automatically whenever an administrator opened wp-admin, requiring no plugin update or user interaction.

Technical Details

• Vulnerability stemmed from insufficient output escaping in the display_id parameter of the Sigmative API, used by the Biggopti component.
• Malicious JavaScript leveraged the authenticated admin session to:
  • Create rogue admin accounts.
  • Deploy a persistence payload (w2.js) that installed a fake plugin (emer-run.php) acting as a webshell.
• The injected code manipulated WordPress database queries to hide rogue accounts from the user list, making detection difficult.

Impact

• Plugins affected: Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, Ultimate Store Kit.
• Scale: Over 350,000 active installs, including 100,000+ for Element Pack alone.
• Timeline: Earliest campaign activity traced back to June 23, 2026.
• Response: WordPress.org closed all BdThemes plugins on August 8, 2026, pending investigation.

Defensive Guidance

• Check for rogue admins: Audit WordPress user tables directly in the database.
• Scan for persistence payloads: Look for suspicious files like emer-run.php.
• Block malicious endpoints: Ensure poisoned API endpoints are not accessible.
• Update or disable affected plugins: Remove BdThemes plugins until official patches are released.
• Monitor supply‑chain risks: Treat third‑party plugin APIs as potential attack surfaces.

Expert in the Cloud Insight

This incident underscores the fragility of plugin supply chains in WordPress ecosystems. By exploiting a single API parsing flaw, attackers weaponized trusted infrastructure to gain persistent administrator access across hundreds of thousands of sites. For defenders, the lesson is clear: plugin APIs must be audited as rigorously as core code, and administrators should monitor for hidden accounts and stealthy persistence mechanisms.