A threat actor compromised the upstream infrastructure behind BdThemes, publisher of the premium WordPress plugin suite Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit, and used it to poison a JSON feed that every one of those plugins fetches on each wp-admin page load. No plugin code on disk was ever modified and no malicious update shipped through WordPress.org — the compromise lived entirely on BdThemes’ side of the wire, in the promotional-banner data the plugins trust by design.

Attack chain

The plugins share a bundled component called the Biggop Library, used to pull promotional banner content from BdThemes’ API (backed by a service referred to as Sigmative). A coding flaw introduced into that library’s JSON response-parsing code in March 2026 fails to escape the display_id field before rendering it (tracked as a CVSS 5.4 XSS issue) — but the actor didn’t need to exploit that flaw directly. Having obtained write access to the vendor’s storage bucket, they simply poisoned the api-data-all-records API response itself, embedding a malicious script (w2.js) inside the data the banner component blindly renders.

Because the banner check fires on every admin dashboard load, the payload executes silently in the browser of any logged-in administrator on an affected site — using that administrator’s real session cookies and REST nonce, the same session-hijack pattern seen in June’s OptinMonster/Awesome Motive CDN attack. The script:

  1. Calls out to a command-and-control server at ia-cdn[.]com/fz/c, sending the victim site’s origin to fetch per-target instructions.
  2. Uses the hijacked admin session to create rogue administrator accounts through the WordPress REST and AJAX APIs.
  3. Uploads a fake plugin that drops a webshell (emer-run.php) for direct code execution.
  4. Installs two must-use (mu-plugins) — which load automatically and don’t appear in the standard plugins list — backdated to September 2025 to blend into normal file timestamps: a “magic login” backdoor granting unauthenticated admin access via a ?_wplogin= token, and a stealth module that hides the rogue accounts from the Users screen.

WordPress security firm Defiant/Wordfence first observed the malicious traffic hitting its WAF on August 7. The affected plugins were pulled from distribution on August 8 pending investigation, though BdThemes plugins are sold directly rather than through the free WordPress.org repository, so removal from any single channel doesn’t guarantee a site stops fetching the poisoned feed. Researchers assess the campaign may have been live since as early as June 23. The C2 infrastructure overlaps with two other recent WordPress supply-chain incidents — the Advanced Responsive Video Embedder compromise (CVE-2026-18072) and the OptinMonster/TrustPulse/PushEngage CDN attack — pointing to a single actor running a sustained campaign against WordPress plugin vendors’ side infrastructure rather than their codebases.

Impact

Element Pack alone reports 100,000+ active installations; combined across the five affected plugins, the exposed install base is substantial for an attack that requires zero interaction from the site owner beyond an administrator loading the dashboard. Because the injection point is server-side (BdThemes’ API, not the plugin package), standard supply-chain defenses — package pinning, lockfile hashes, code review of plugin updates — do nothing here: the plugin version installed on a victim site can be completely unmodified and still serve the attack. This is the same class of blind spot exposed by the OptinMonster CDN incident two months ago: any third-party asset a plugin fetches at runtime is part of your attack surface, whether or not it ships as installed code.

Mitigation

If you run Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, or Ultimate Store Kit:

  • Audit administrator accounts now. Look for unfamiliar usernames and anything created outside your normal onboarding process; the stealth mu-plugin hides rogue accounts from the dashboard, so check the wp_users table directly via database access or WP-CLI (wp user list), not just the admin UI.
  • Inspect wp-content/mu-plugins/ by hand. Must-use plugins load without appearing in the standard plugin list — look for anything with a September 2025 timestamp that you didn’t put there, and for files referencing _wplogin or emer-run.
  • Search for the webshell (emer-run.php) and any unfamiliar plugin directories with a server-side file scan; the dashboard cannot be trusted to show it.
  • Block ia-cdn[.]com at the DNS or firewall layer.
  • Rotate credentials — admin passwords, WordPress secret keys/salts in wp-config.php, and any API keys stored in the WordPress database — on any site where a compromise is confirmed.
  • Until BdThemes confirms remediation of the feed itself, consider blocking outbound requests to the vendor’s banner/promo endpoints at the network layer, since disabling the plugin’s admin-notice UI does not necessarily stop the underlying fetch.

The broader lesson for teams running any commercial WordPress plugin: audit not just what code you install, but what remote data that code is allowed to fetch and render with trust. A vendor’s marketing banner should never be able to execute JavaScript with an administrator’s privileges.

Sources: BleepingComputer · The Hacker News · GBHackers · Infosecurity Magazine