BdThemes WordPress Plugins Compromised in Supply Chain Attack

• •Attackers exploited a supply chain vulnerability in BdThemes plugins to create rogue admin accounts.
• •No plugin files were modified; the attack leveraged a poisoned promotional API feed.
• •The vulnerability, introduced in March 2026, remains unpatched as of August 10, 2026.

A supply chain attack targeting BdThemes WordPress plugins has compromised multiple sites by enabling attackers to create rogue admin accounts and deploy web shells without modifying any plugin files. The attack was detected on August 7, 2026, when Wordfence reported that attackers poisoned a promotional API feed used by several popular BdThemes plugins, including Element Pack and Prime Slider. The vulnerability stemmed from a cross-site scripting (XSS) flaw introduced in March 2026, allowing attackers to exploit the JSON response parsing code. This enabled them to use the legitimate administrator's session to create unauthorized admin accounts and install malicious plugins. The affected plugins have been temporarily removed from the WordPress repository pending a full review. As of now, the vulnerability remains unpatched, and site owners are advised to audit their databases for signs of compromise.