New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response

Cybersecuritynews •Abinaya • August 10, 2026

A supply chain attack targeting BdThemes WordPress plugins has exposed site administrators to account takeover, webshell deployment, and persistent backdoors. Wordfence Threat Intelligence was notified of the incident on August 7, 2026, after discovering that attackers had poisoned a remote promotional API feed used by several popular BdThemes plugins. The affected plugins include Element Pack […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BdThemes WordPress Plugins Compromised in Supply Chain Attack A supply chain attack targeting BdThemes WordPress plugins has compromised multiple sites by enabling attackers to create rogue admin accounts and deploy web shells without modifying any plugin files. The attack was detected on August 7, 2026, when Wordfence reported that attackers poisoned a promotional API feed used by several popular BdThemes plugins, including Element Pack and Prime Slider. The vulnerability stemmed from a cross-site scripting (XSS) flaw introduced in March 2026, allowing attackers to exploit the JSON response parsing code. This enabled them to use the legitimate administrator's session to create unauthorized admin accounts and install malicious plugins. The affected plugins have been temporarily removed from the WordPress repository pending a full review. As of now, the vulnerability remains unpatched, and site owners are advised to audit their databases for signs of compromise. 4 sources 69

Extracted Entities

New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (2)

Platforms (2)