A routine promotional banner loading inside WP dashboard sparked news concerns as attackers poisoned remote data feed used by BdThemes plugins, turning seven popular extensions, including Element Pack, Prime Slider and Ultimate Post Kit, into an unexpected gateway for malicious code.
What followed was far more serious than a simple plugin flaw, rogue administrator accounts, a web shell and hidden backdoors were planted on compromised sites, leaving victims exposed even after the original plugins were updated.
A sophisticated supply-chain compromise targeting seven BdThemes WordPress plugins allowed attackers to weaponize a trusted remote data feed, create rogue administrator accounts and install persistent backdoors—without modifying the plugins distributed through WordPress.org.
A major WordPress security incident put websites using seven popular BdThemes plugins at risk after attackers compromised an external data source used by the extensions and turned a promotional feature into a delivery mechanism for malicious JavaScript.
- Element Pack Addons for Elementor (
bdthemes-element-pack-lite) - Prime Slider Addons for Elementor (
bdthemes-prime-slider-lite) - Pixel Gallery Addons for Elementor (
pixel-gallery) - Ultimate Post Kit Addons for Elementor (
ultimate-post-kit) - Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor (
ultimate-store-kit) - Live Copy Paste for Elementor (
live-copy-paste) - Smart Admin Assistant (
smart-admin-assistant)
Security researchers at Wordfence say the campaign exploited inadequate client-side escaping in the plugins’ Biggopti promotional banner functionality. The underlying weakness was introduced in March 2026 and was associated with the display_id parameter in the Sigmative API.
But rather than tampering with plugin files themselves, the attackers reportedly gained unauthorized write access to a DigitalOcean Spaces storage bucket supplying JSON responses to the plugins.
That distinction made the attack particularly difficult to detect.
The plugins could remain unchanged while their trusted remote data source delivered malicious content to administrators visiting the WordPress dashboard.
Once attackers poisoned promotional JSON files, malicious JavaScript could be delivered whenever an authenticated administrator loaded the affected component in the WordPress admin area. The injected script contacted the attackers’ command-and-control infrastructure at ia-cdn.com, where it could obtain additional instructions.
The campaign then moved beyond browser-based exploitation.
According to Wordfence’s investigation, the attackers used the WordPress REST API to create unauthorized administrator accounts and downloaded a malicious archive named wp-smart-thumbnails. Inside that archive was a web shell called emer-run.php, giving the attackers another avenue for controlling compromised websites.
The attackers also planted malicious files in WordPress’ Must-Use plugins directory, a location that can provide persistence outside the normal plugin-update process.
One component reportedly implemented a “magic login” mechanism that could permit administrative access without normal authentication when specific URL parameters were supplied.
The affected plugins were removed from the official WordPress.org directory on August 7 and 8.
However, researchers warn that removing or updating the plugins is not enough for websites that have already been compromised.
Known Files and Hashes
Wordfence identified several files associated with the campaign:
emer-run.php— MD5:1024732009983dd5e54b4cf5593f04d4class-wp-token-validate.php— MD5:7719cd98a35ffad2771f26d1ceab7d27class-wp-query-9d127ff3.php, or similarly namedclass-wp-query-*.phpfiles — MD5:9aadc3e5c5242b273bd17c5bdc358845wp-cache-optimizer.php— MD5:e450ae5bc4bfc0d960dded06a76bb8e9
Researchers also identified two suspicious WordPress database options:
fz_emer_login_tokensfz_emer_done_v1
The first reportedly stores magic-login tokens, while the second acts as an indicator that the malicious process has already completed.
The incident demonstrates how modern software supply-chain attacks can bypass traditional assumptions about plugin security.
In a conventional compromise, attackers might modify source code, replace a plugin package or inject malware directly into files distributed to users. Here, the attackers reportedly did none of those things. Instead, they compromised infrastructure sitting outside the plugin itself.
As Wordfence researcher Paolo Tresso explained, the attack involved poisoning a remote JSON stream consumed by an administrative promotional component rather than altering the source code hosted on WordPress.org. That approach effectively turned a legitimate plugin feature into a remote malware delivery channel.
