The Wordfence Threat Intelligence Team alerted users on August 7, 2026 regarding a serious supply chain compromise impacting BdThemes, a provider of WordPress plugins found in the official WordPress plugins directory. Following the discovery, all affected plugins have been temporarily suspended while they undergo thorough inspection and investigation by the WordPress Plugins team.
An in-depth analysis uncovered a sophisticated supply chain breach affecting several plugins, distinguishing itself from typical software supply chain attacks by the absence of modified source code files within the official WordPress.org repository. Instead, threat actors compromised a static remote JSON data stream associated with an administrative promotional banner component.
At Wordfence, we offer comprehensive security monitoring and malware removal solutions to our Wordfence Care and Response customers. In the event of a security threat, our incident response team conducts a detailed investigation to identify the root cause, eliminate malware, and address complications arising from an infection. During the cleanup process, malware samples are incorporated into our Threat Intelligence database, which now contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner are adept at detecting over 99% of these samples when used with our premium signatures set, providing crucial protection even if WordPress becomes non-functional.
Vulnerability Summary from Wordfence Intelligence
A significant vulnerability has been identified in the Biggopti Library, which affects various versions through Cross-Site Scripting (XSS) via the display_id parameter from the Sigmative API.
- CVSS Rating: 5.4 (Medium) – Unpatched
- Affected Software:
- Element Pack Addons for Elementor
- Live Copy Paste for Elementor
- Pixel Gallery Addons for Elementor
- Prime Slider Addons for Elementor
- Smart Admin Assistant
- Ultimate Post Kit Addons for Elementor
- Ultimate Store Kit
The vulnerability allows attackers who manage to compromise the Sigmative API server to inject arbitrary web scripts into pages, potentially impacting users accessing those compromised pages.
Technical Analysis
Plugins from BdThemes utilize a component known as Biggopti to fetch promotional banners from their API server, which lacks dynamic application server features. Instead, it serves static JSON files from an object storage solution secured by Cloudflare.
Through careful analysis, it was discovered that the XSS vulnerability stemmed from an oversight in the JSON response parsing code, allowing unauthorized actors with write access to replace legitimate JSON data with crafted payloads that take advantage of this flaw. This results in script execution within the browsers of logged-in administrators whenever a wp-admin page loads silently.
Importantly, the attack does not require any plugin updates, as no files are changed on disk. This API-driven attack is stealthy enough to evade traditional integrity scanners and goes unnoticed by Web Application Firewalls.
XSS Vulnerability Exposed to Administrators
Every BdThemes plugin employing the Biggopti system loads a client-side JavaScript asset that executes on every wp-admin page load, fetching promotional data from the vendor’s API endpoint. This script directly incorporates data from the remote JSON response into an HTML id attribute without adequate client-side escaping.
The unescaped injection was traced back to a March 1, 2026 commit in the Prime Slider (bdthemes-prime-slider-lite) version 4.1.9, which was then propagated to other plugins. Although subsequent updates incorporated sanitization methods for some content fields, the id attribute injection was not fixed, allowing the exploit to persist.
Malicious actors replacing legitimate JSON responses with payloads were able to execute scripted actions silently, generating rogue administrator accounts and deploying webshell plugins.
Multi-Stage Multi-Payload Architecture
The malicious event handler instigates a multi-stage attack by fetching external scripts depending on the availability of the attacker’s infrastructure.
Primary Payload (w2.js)
This main payload, which is executed within the authenticated administrator’s session, performs a sequence of actions that include:
- C2 Verification: Contacts the command-and-control server (C2) with the site’s origin to receive targeting instructions.
- Rogue Administrative Account Creation: Uses the active admin session’s nonce to create a new administrator account.
- Webshell Installation: Downloads a fake plugin archive from the C2 server and installs it through the standard plugin upload form.
- Must-Use Plugin Backdoors: Installs backdoor modules to allow unauthorized administrative entry and manipulate database queries to conceal rogue accounts.
- Exfiltration: Sends all execution results back to the C2 server.
Alternate Payload (x.js)
The secondary script generates specific administrative credentials derived from the victim’s hostname, crafting predictable usernames and passwords that allow attackers to create rogue admin accounts, further exfiltrating the outcomes to the C2 server.
Threat Actors & Scope
The C2 domain associated with this campaign has links to previous supply chain attacks involving Advanced Responsive Video Embedder and OptinMonster in recent months. The aim of this operation is to establish widespread, silent administrative access and execute remote code within numerous WordPress environments.
This attack illustrates an alarming evolution in the threat landscape for WordPress site owners, demonstrating how compromising a vendor’s remote data pipeline can function as an effective method of exploiting underlying code vulnerabilities.
Indicators of Compromise (IoCs)
Affected Plugins:
- Element Pack Addons for Elementor
- Prime Slider Addons for Elementor
- Pixel Gallery Addons for Elementor
- Ultimate Post Kit Addons for Elementor
- Ultimate Store Kit
- Live Copy Paste for Elementor
- Smart Admin Assistant
External Resources:
- Primary Payload URL: ia-cdn[.]com/fz/w2.js
- C2 Beacon Endpoint: ia-cdn[.]com/fz/c
- Compromised Vendor API Endpoints (now cleaned):
- api[.]sigmative[.]io/prod/store/api/biggopti/api-data-all-records
- api[.]sigmative[.]io/prod/store/api/biggopti/api-data-records
- api[.]sigmative[.]io/prod/store/api/biggopti/x.js
Conclusion
This detailed analysis reveals a Cross-Site Scripting (XSS) vulnerability leveraged by an API-driven supply chain attack within the BdThemes plugin ecosystem. This breach allows unauthorized script execution in authenticated administrator sessions by manipulating remote JSON promotional data.
As this supply chain attack evolved, it highlights critical security implications for WordPress site owners, encouraging proactive steps to audit databases and plugin directories for signs of compromise. We advise all owners of BdThemes plugins to conduct immediate audits. Our Wordfence Premium, Care and Response, and paid Wordfence CLI customers received malware signatures and WAF rules on August 7, 2026, while free users will gain access to these protections after the standard 30-day period.
