Wordfence was notified of the compromise on August 7 and published its analysis the following day.
How a promotional banner feed became an attack vector
Seven plugins published by BdThemes — an Elementor add-on vendor whose plugins are distributed through the official WordPress.org directory — were used to plant rogue administrator accounts and webshells on live sites without a single plugin file being modified. The plugins include a component called Biggopti that pulls promotional banners from the vendor's API into the wp-admin dashboard. Attackers obtained write access to the object storage bucket behind that feed and swapped legitimate responses for crafted payloads.
The root cause was an unescaped field in a banner notice. Wordfence traced the flaw through SVN history to March 1, when a script added to Prime Slider began concatenating a field from the remote JSON response directly into an HTML attribute without escaping it. A neighboring attribute in the same code was escaped correctly; a sanitizer added in May left the flawed attribute untouched. Because the script runs on every wp-admin page load, the injected code fires silently in the browser of any logged-in administrator.
From injected banner to account takeover and persistent access
The malicious banner responses carried payloads that used the administrator’s own session token to create a new administrator account through the WordPress REST API, then installed a fake plugin that contained a webshell. That webshell deployed two persistence modules: one that granted unauthenticated administrative access via a URL parameter, and a second that hooked database queries to hide the rogue accounts from the user list and adjust user counts to match.
A second payload, hosted on BdThemes' own infrastructure, derived administrator credentials from the victim site's hostname. Wordfence noted this meant responders could compute exactly what to hunt for when searching infected sites.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadScope, repository status, and severity
Wordfence reported that nothing in the WordPress.org plugin repository had changed — the attacker manipulated external content that the plugins loaded rather than modifying plugin files. All seven BdThemes plugins implicated by the analysis have been temporarily closed pending review. The vulnerability record in Wordfence’s analysis assigned a 5.4, medium-severity score and listed the issue as unpatched.
Because the malicious code executed only when an administrator loaded the dashboard, the compromise could occur silently on otherwise up-to-date installations that rely on those plugins for promotional content.
Connections to recent incidents and remediation status
Wordfence linked the command-and-control domain associated with these payloads to the actors behind compromises of the Advanced Responsive Video Embedder and OptinMonster plugins over the past two months, and said a payload sitting in the vendor’s own bucket pointed to a serious upstream compromise of the vendor’s infrastructure. Both endpoints implicated in the Biggopti feed were reported clean by August 8.
What site owners, incident responders, and BdThemes should check
- Site owners: Wordfence urged that, because plugin files were never modified, operators should audit database user lists, plugin directories and the options table for indicators of compromise rather than relying only on file-system checks.
- Incident responders: Use the fact that one payload derived administrator credentials from the victim hostname to compute and hunt for known indicators tied to that derivation method; search for fake plugins and webshell artifacts installed via the REST API and for user-list hiding behavior in database query hooks.
- BdThemes (the vendor): Review object storage access and the integrity of the Biggopti promotional feed, and investigate the upstream write access that allowed crafted responses to replace legitimate banner content.
This case highlights a practical lesson in attack surface: a third‑party content feed, treated as presentation only, became a delivery mechanism for privilege escalation and persistent access. With repository files unchanged and endpoints reported clean as of August 8, the short-term cleanup is possible — but discovery depends on the kinds of database and options-table checks Wordfence recommends, and on vendors closing the upstream control points that let attackers poison promotional content.
