BdThemes plugins poisoned through the vendor's banner feed

Wordfence was notified on August 7, 2026 of a supply-chain compromise affecting BdThemes, a WordPress plugin vendor whose Elementor add-ons ship through the official WordPress.org directory. No plugin source file was modified. The attackers poisoned a static JSON feed the plugins fetch, and let the vendor's own code do the rest.

Seven BdThemes plugins bundle a component called Biggopti, which pulls promotional banners from the vendor's API and renders them in the WordPress dashboard. The API is not an application server. It is flat JSON files in a DigitalOcean Spaces bucket behind Cloudflare. Every plugin using Biggopti enqueues its client-side script on admin_init, so it runs on every wp-admin page load for every logged-in administrator. The flaw was the vendor's own. When the script builds the notice container, it concatenates the display_id field from the remote JSON straight into an HTML id attribute with no escaping, while escaping data-display-id properly a few lines later, which is how Wordfence concluded this was an oversight rather than a design. SVN history put the unescaped write at March 1, 2026, in Prime Slider 4.1.9, from where it spread to the other plugins.

Someone with write access to the bucket replaced the legitimate records. The poisoned display_id broke out of the attribute and attached an onanimationstart handler fired by a 10-millisecond CSS animation, so the payload ran silently on any dashboard page. The handler pulled w2.js from ia-cdn[.]com, which checked in with the C2, created an administrator through the WordPress REST API using the live session's X-WP-Nonce, installed a fake plugin under a slug like wp-smart-thumbnails containing a webshell named emer-run.php, and used that webshell to drop two must-use plugins: a magic login backdoor keyed to a ?_wplogin=<token> parameter, and a stealth module that filters the rogue accounts out of the user list and adjusts the user counts to match. Both were backdated to September 2025. A second payload, x.js, was served from BdThemes' own infrastructure and generated deterministic credentials from the site hostname, meaning the operators never had to keep a victim list, and responders can compute the exact username and password to hunt for.

Wordfence tracked the campaign back to a start_date of June 23, 2026 in the poisoned records, the earliest the XSS could have been live. The affected plugins were closed on the WordPress directory on August 7, and both API endpoints were serving clean JSON by August 8. Wordfence linked the C2 domain to the same operators behind the Advanced Responsive Video Embedder and OptinMonster compromises earlier in the summer, and noted that the presence of attacker-controlled files inside the vendor's own bucket points to a deeper compromise of BdThemes' cloud storage credentials.