That observation frames a supply chain compromise disclosed in August 2026 that abused a BdThemes plugin component to poison JSON served into WordPress administrative dashboards. The malicious data triggered an XSS flaw that, once executed in a logged‑in administrator's browser, created backdoor administrators, deployed a PHP web shell, and installed persistent, stealthy modules — all without changing plugin files on disk or pushing an update through the WordPress.org repository.
How Biggopti and the Sigmative API were abused
The vulnerable component is Biggopti, an internal library BdThemes ships with several plugins to render promotional banners in the WordPress admin. Biggopti fetches static JSON from a DigitalOcean Spaces bucket via an API described in the vendor infrastructure as the Sigmative API. Wordfence says the JSON parsing code failed to perform sufficient client‑side escaping for the "display_id" parameter, enabling a cross‑site scripting (XSS) injection.
Because the injected script executes on every "wp-admin" page load for logged‑in administrators, the vulnerability carries repeated execution in the browser. Wordfence rated this XSS at CVSS 5.4 (medium severity). The change that introduced the behavior appeared first on March 1, 2026 in the "bdthemes-prime-slider-lite" plugin before being rolled into other BdThemes components.
Payload mechanics: w2.js, x.js and the chain to persistence
Wordfence traced two JavaScript payloads used by attackers. The main payload, served via an "api-data-all-records" endpoint and named "w2.js," performs a sequence of automated actions:
- Contacts a command‑and‑control (C2) server at "ia-cdn[.]com/fz/c" with the victim site's origin to fetch targeting instructions and aborts if the server returns "skip" or "done".
- Creates a new rogue administrator account through the WordPress REST API.
- Downloads a fake plugin ZIP from the C2 server and installs it using the standard plugin upload form, deploying a PHP web shell called "emer-run.php".
- Uses the web shell to install two persistence modules into the "mu-plugins" (Must‑Use plugins) directory: a "magic-login" backdoor that permits unauthenticated administrative entry via a URL parameter (?_wplogin=) targeting the site's longest‑registered administrator, and an anti‑analysis stealth module that hooks into database queries to hide the rogue accounts and exclude them from the displayed user count.
An alternate payload, "x.js", served from the developer's infrastructure via "api-data-records", instead generates deterministic administrative credentials derived from the victim hostname: usernames of the form bd_ plus a six‑character base36 hash, and passwords of the form Bd@26! plus the hash and x, paired with an @wordpress.org email address. Because these credentials are deterministic, Wordfence noted attackers need not centrally store a list of compromised sites — incident responders can compute the exact username and password to hunt for on suspected domains. Results of successful compromises are exfiltrated back to the C2 server.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePlugins affected and WordPress' immediate action
WordPress' plugins team temporarily disabled downloads for the following BdThemes plugins as of August 7 or 8, 2026, pending a full review:
- Element Pack Addons for Elementor — bdthemes-element-pack-lite (100,000+ active installs)
- Live Copy Paste for Elementor — live-copy-paste (6,000+ active installs)
- Pixel Gallery Addons for Elementor — pixel-gallery (N/A)
- Prime Slider Addons for Elementor — bdthemes-prime-slider-lite (N/A)
- Smart Admin Assistant — smart-admin-assistant (N/A)
- Ultimate Post Kit Addons for Elementor — ultimate-post-kit (N/A)
- Ultimate Store Kit — ultimate-store-kit (6,000+ active installs)
Wordfence says the attack was notable because it required no plugin updates or disk‑file changes — attackers replaced legitimate JSON in the vendor's cloud bucket and served crafted payloads to administrative dashboards.
C2 infrastructure and links to prior supply chain incidents
Wordfence assesses the C2 server used in this campaign is related to two other recent software supply chain attacks: one involving Advanced Responsive Video Embedder (CVE-2026-18072) and another involving OptinMonster. In those prior cases, plugins were backdoored to provide administrative access through either a hard‑coded token or a hidden administrator account and a concealed plugin installed only when a site admin logged in. Wordfence summarizes the campaign's objective as establishing covert administrative persistence and remote code execution across WordPress environments.
What this means for WordPress administrators, BdThemes, and incident responders
WordPress administrators will need to check for artifacts the campaign leaves behind: unexpected administrator users; a PHP web shell named "emer-run.php"; mu‑plugins that implement a "magic‑login" backdoor or anti‑analysis hooks; and deterministic usernames beginning with "bd_" followed by a six‑character base36 hash (paired with passwords of the predictable form described by Wordfence). WordPress had already removed the plugins from download pending a "full review" as of August 7–8, 2026.
BdThemes faces an urgent investigation into its cloud storage credentials or internal infrastructure; Wordfence says malicious JSON and the secondary x.js payload being uploaded directly into the vendor's DigitalOcean Spaces bucket indicates a severe upstream compromise.
Incident responders can use the deterministic credential algorithm described by Wordfence to hunt for compromised sites and should treat exfiltration back to "ia-cdn[.]com/fz/c" as an indicator of compromise tied to this campaign.
The episode arrives days after WordPress addressed a separate pre‑authentication reflected XSS, CVE-2026-64638 (XSS2Shell, CVSS 8.9), highlighting how different XSS vectors — one exploited via vendor‑hosted JSON and another addressed in core — can both lead to server‑side control when administrators are targeted.
