WordPress Supply Chain Attack Exploits BdThemes Plugins to Create Rogue Admin Accounts and Install Webshells

Gbhackers •Divya • August 10, 2026

A supply chain compromise affecting multiple BdThemes WordPress plugins has allowed attackers to hijack administrator sessions, create unauthorized admin accounts, and deploy persistent web shells, without modifying the plugin source code or requiring a plugin update. Wordfence Threat Intelligence reported being notified of the incident on August 7, 2026. The affected plugins, distributed through the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BdThemes WordPress Plugins Compromised in Supply Chain Attack A supply chain attack targeting BdThemes WordPress plugins has compromised multiple sites by enabling attackers to create rogue admin accounts and deploy web shells without modifying any plugin files. The attack was detected on August 7, 2026, when Wordfence reported that attackers poisoned a promotional API feed used by several popular BdThemes plugins, including Element Pack and Prime Slider. The vulnerability stemmed from a cross-site scripting (XSS) flaw introduced in March 2026, allowing attackers to exploit the JSON response parsing code. This enabled them to use the legitimate administrator's session to create unauthorized admin accounts and install malicious plugins. The affected plugins have been temporarily removed from the WordPress repository pending a full review. As of now, the vulnerability remains unpatched, and site owners are advised to audit their databases for signs of compromise. 4 sources 69

Extracted Entities

WordPress Supply Chain Attack Exploits BdThemes Plugins to Create Rogue Admin Accounts and Install Webshells

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Platforms (1)