BdThemes WordPress Plugins Security Vulnerability
Admin accounts compromised through JSON file manipulation.
1Security Vulnerability Discovered
A serious security vulnerability was discovered in WordPress plugins developed by BdThemes. This vulnerability allows admin accounts to be compromised through the manipulation of JSON files. Wordfence researchers noted that attackers exploited this flaw without altering the source code in the official WordPress repository.
2Affected Plugins
BdThemes plugins listed on the WordPress plugin directory were temporarily disabled on August 7-8, 2026. Users cannot download these plugins while awaiting a full review. The Biggopti component within these plugins became the target of attackers.
3API Manipulation
Attackers manipulated JSON files fetched from a DigitalOcean Spaces bucket, injecting malicious code into the WordPress admin panel. This code executed silently on every wp-admin page load, leading to the compromise of admin accounts.
4CVSS Score and Severity
The vulnerability was rated 5.4 on the CVSS scoring system, indicating medium severity. This flaw could lead to serious consequences such as admin account takeover and remote code execution.
5Attack Initiation
The attack began on March 1, 2026, with the 'bdthemes-prime-slider-lite' plugin and spread to others. The attack was entirely API-driven and did not require plugin updates or file modifications.
6Impact of Malicious Code
The injected code created rogue admin accounts, uploaded a web shell plugin, and connected to a command-and-control server. This process enabled attackers to establish persistence and execute remote code in WordPress environments.
7Connection to Other Attacks
This attack was linked to other software supply chain attacks involving Advanced Responsive Video Embedder and OptinMonster. Similar techniques were used to target WordPress plugins in these attacks.
8Outcome and Precautions
Wordfence stated that BdThemes' cloud storage credentials or internal infrastructure were severely compromised. This development underscores the need for enhanced security measures in WordPress environments.
Original article: The Hacker News — BdThemes WordPress Eklentilerinde Güvenlik Açığı