Element Pack alone shows more than 100,000 active installations on WordPress.org — a single data point that helps explain why a stealthy supply‑chain modification at BdThemes quickly became a widespread, high‑stakes problem.
BdThemes footprint and affected products
BdThemes develops premium WordPress plugins and advertises a portfolio with over 350,000 active installs. Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations, and other paid products include Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review; the affected plugins were pulled from the WordPress.org directory on August 8.
How the attacker used the Sigmative API and Biggop Library
Researchers at Wordfence, part of security firm Defiant, report the compromise began upstream in the vendor’s infrastructure when an attacker obtained write access to a storage bucket and “poisoned a static remote JSON data stream fetched by an administrative promotional banner component.” The injected payload exploited a cross‑site scripting (XSS) flaw introduced in March 2026 in the JSON response‑parsing code.
Defiant explains the vulnerable component by name: the Biggop Library used by the Biggopti component is responsible for fetching promotional banners from the vendor’s API server and presenting them in customers’ WordPress admin dashboards. As Wordfence researchers put it, “The Biggop Library is vulnerable to Cross‑Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleStealthy mechanics: rogue admin accounts and a persistent webshell
The practical result was a fully stealthy, API‑driven compromise that requires no user interaction, no file modification on the site by the administrator, and no plugin update. Defiant’s report says the malicious JavaScript used the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites. An additional payload (w2.js) then established persistence by installing a fake plugin that dropped a webshell named emer‑run.php.
Because the attack operates inside authenticated admin sessions, the payload runs “every time a logged‑in administrator opens a wp‑admin page.” The injected code also manipulates WordPress database queries to hide the rogue administrator accounts from the user list, making the compromise more difficult to spot. Defiant assigned the issue a “medium” severity score and listed it as unpatched at the time of publishing; two previously poisoned API endpoints now return clean JSON data.
Timeline: March flaw, June activity, August takedown
According to the researchers, the coding flaw that allowed XSS was introduced in March 2026. Defiant’s Wordfence began seeing attacks through its Wordfence web application firewall on August 7 and, after reviewing records, determined the earliest possible start of the campaign was June 23. Following discovery, the WordPress Plugins team pulled the affected plugins from WordPress.org on August 8 pending investigation.
What this means for security teams, WordPress administrators, and BdThemes
- Technologists and security teams: The attack demonstrates a supply‑chain vector that requires no plugin updates or file changes on the target site — a JSON feed consumed by admin dashboards can be the attack surface. Teams will need to inspect admin‑facing network requests and WAF alerts tied to vendor APIs, and confirm endpoints now returning clean JSON actually match expected schemas.
- WordPress site administrators using BdThemes plugins: Administrators should assume that visits to wp‑admin while logged in could have been leveraged to create hidden admin accounts and to install a webshell; because the injected code hides rogue accounts from user listings, manual account reviews may miss compromises. The affected BdThemes products were removed from the directory on August 8, and two poisoned API endpoints now return clean JSON, but Defiant reported the vulnerability as unpatched at the time of publishing.
- BdThemes and platform governance: The vendor had not published an official statement on its website at the time of the report, and BleepingComputer’s request for comment to BdThemes went unanswered. The WordPress Plugins team has closed the listings pending a full review, a step that removes distribution but does not remediate existing installations that may have been exploited.
Attribution links and remaining questions
Defiant’s Wordfence researchers say reports link the command‑and‑control infrastructure used in the observed attacks to the same actor behind recent supply‑chain compromises of Advanced Responsive Video Embedder and OptinMonster. That connection, combined with the timing (flaw introduced in March, earliest campaign activity June 23, WAF detections August 7, plugins pulled August 8), frames this incident as part of a broader pattern of upstream compromises that weaponize administrative integrations.
Two poisoned endpoints are reportedly returning clean JSON, but the exploit remained listed as unpatched at publication and the vendor had not offered a public remediation statement. The record in the Defiant report leaves operators with concrete dates and behaviors to investigate — and with the urgent practical question: how many active admin sessions or existing installations were silently backdoored before the plugins were removed from distribution?
