# BdThemes WordPress Plugins Security Vulnerability

Admin accounts compromised through JSON file manipulation.

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-08-11
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html>
- **On Brifing:** https://brifing.si/s/10c0be60-b142-4682-b189-6943a94cd478

## Security Vulnerability Discovered

A serious security vulnerability was discovered in WordPress plugins developed by BdThemes. This vulnerability allows admin accounts to be compromised through the manipulation of JSON files. Wordfence researchers noted that attackers exploited this flaw without altering the source code in the official WordPress repository.

## Affected Plugins

BdThemes plugins listed on the WordPress plugin directory were temporarily disabled on August 7-8, 2026. Users cannot download these plugins while awaiting a full review. The Biggopti component within these plugins became the target of attackers.

## API Manipulation

Attackers manipulated JSON files fetched from a DigitalOcean Spaces bucket, injecting malicious code into the WordPress admin panel. This code executed silently on every wp-admin page load, leading to the compromise of admin accounts.

## CVSS Score and Severity

The vulnerability was rated 5.4 on the CVSS scoring system, indicating medium severity. This flaw could lead to serious consequences such as admin account takeover and remote code execution.

## Attack Initiation

The attack began on March 1, 2026, with the 'bdthemes-prime-slider-lite' plugin and spread to others. The attack was entirely API-driven and did not require plugin updates or file modifications.

## Impact of Malicious Code

The injected code created rogue admin accounts, uploaded a web shell plugin, and connected to a command-and-control server. This process enabled attackers to establish persistence and execute remote code in WordPress environments.

## Connection to Other Attacks

This attack was linked to other software supply chain attacks involving Advanced Responsive Video Embedder and OptinMonster. Similar techniques were used to target WordPress plugins in these attacks.

## Outcome and Precautions

Wordfence stated that BdThemes' cloud storage credentials or internal infrastructure were severely compromised. This development underscores the need for enhanced security measures in WordPress environments.

## Sources covering this story

- https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._