WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)

Key facts for BdThemes DigitalOcean Spaces feed

Detection coverage for BdThemes DigitalOcean Spaces feed

As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1971 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BdThemes Biggopti Poisoned Feed — Obfuscated XSS Payload Fetch & C2 Callback

Detects the exploitation stage of the BdThemes/Biggopti supply-chain XSS chain: a wp-admin session pulling the poisoned api.sigmative.io promotional-banner feed and the browser then fetching the eval(String.fromCharCode(...))-decoded w2.js/x.js loader from the attacker's ia-cdn.com C2. This is the first observable network signature before any account or file changes occur on the host.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1584, T1608.001, T1195.002, T1059.007, T1027
• Data sources: proxy, dns, web_access_logs, cloudflare_waf
• Severity: high
• Confidence: high

Splunk SPL

index=proxy OR index=web sourcetype IN ("proxy","stream:http","wp_access_combined")
| search (dest_domain="ia-cdn.com" OR dest_domain="api.sigmative.io" OR url="*api.sigmative.io/prod/store/api/biggopti*" OR url="*ia-cdn.com/fz/c*")
| eval stage=case(match(url,"biggopti"),"poisoned_feed_fetch", match(url,"ia-cdn\.com"),"c2_payload_or_callback", true(),"other")
| eval referrer_is_wpadmin=if(match(referer,"(?i)/wp-admin/"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls by src_ip, user, dest_domain, stage, referrer_is_wpadmin
| where stage!="other"

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("ia-cdn.com", "api.sigmative.io/prod/store/api/biggopti", "ia-cdn.com/fz/c")
| extend Stage = case(RemoteUrl has "biggopti", "poisoned_feed_fetch", RemoteUrl has "ia-cdn.com", "c2_payload_or_callback", "other")
| where Stage != "other"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, Stage
| summarize EventCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, RemoteUrl, Stage

Sigma

title: BdThemes Biggopti Poisoned Feed — XSS-to-C2 Payload Fetch
id: d3f1e2b0-1971-4a1c-9c3e-100000000001
status: experimental
description: Detects outbound connections from a WordPress admin context to the poisoned Biggopti promotional feed (api.sigmative.io) or the w2.js/x.js C2 loader (ia-cdn.com), consistent with the BdThemes supply-chain XSS chain
references:
  - https://www.wordfence.com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/10
tags:
  - attack.resource-development
  - attack.t1584
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.defense-evasion
  - attack.t1027
logsource:
  category: proxy
detection:
  selection_feed:
    c-uri|contains: 'api.sigmative.io/prod/store/api/biggopti'
  selection_c2:
    r-dns|contains: 'ia-cdn.com'
  condition: 1 of selection_*
falsepositives:
  - Legitimate pre-compromise or post-remediation BdThemes plugin traffic to api.sigmative.io outside the 2026-06-23 to 2026-08-08 poisoning window
level: high

Known false positives:

• Legitimate pre-compromise (before 2026-06-23) or post-remediation (after 2026-08-08) BdThemes plugin traffic to api.sigmative.io fetching an unpoisoned, benign promotional record

Tuning notes: Scope alerting priority to the confirmed poisoning window (2026-06-23 through 2026-08-08); where full HTTP response body capture is available, additionally match the onanimationstart / eval(String.fromCharCode( pattern in the biggopti response body to eliminate any residual benign-feed noise.

• 🔒 BdThemes Biggopti Poisoned Feed — Obfuscated XSS Payload Fetch & C2 Callback · unlock with TL Creds
• 🔒 Rogue WordPress Admin Creation & mu-plugins Backdoor Drop (bd_ / wp-smart-thumbnails) · unlock with TL Creds
• 🔒 Magic-Login Backdoor Token Use (_wplogin=) & Ongoing [indicator] C2 Beacon · unlock with TL Creds
• 🔒 BdThemes Biggopti Poisoned Feed — Obfuscated XSS Payload Fetch & C2 Callback · unlock with TL Creds
• 🔒 Rogue WordPress Admin Creation & mu-plugins Backdoor Drop (bd_ / wp-smart-thumbnails) · unlock with TL Creds
• 🔒 Magic-Login Backdoor Token Use (_wplogin=) & Ongoing [indicator] C2 Beacon · unlock with TL Creds
• 🔒 Rogue WordPress Admin Creation & mu-plugins Backdoor Drop (bd_ / wp-smart-thumbnails) · unlock with TL Creds
• 🔒 Magic-Login Backdoor Token Use (_wplogin=) & Ongoing [indicator] C2 Beacon · unlock with TL Creds

Indicators of compromise for BdThemes DigitalOcean Spaces feed

As of 2026-08-10, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1971.

Sample indicators (3 of 20)

• Domain: ia-cdn[.]com
• File hash: 1024732009983dd5e54b4cf5593f04d4
• Domain: api[.]sigmative[.]io

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How BdThemes DigitalOcean Spaces feed works

On August 7, 2026 the Wordfence Threat Intelligence Team was notified of a supply chain compromise affecting the BdThemes WordPress plugin ecosystem. Seven BdThemes plugins — Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant — share a 'Biggopti' component that fetches promotional banner data from a static JSON feed hosted on a DigitalOcean Spaces bucket (fronted by Cloudflare) at api.sigmative.io. A cross-site scripting flaw tracked with CVSS 5.4, introduced March 1, 2026 in Prime Slider v4.1.9, left the feed's display_id field concatenated directly into an HTML id attribute without escaping, while every other field in the same response was properly sanitized.

Attackers who gained control of the feed (indicating compromised cloud storage or vendor API credentials, not a bug in the plugins' own escaping logic for other fields) began poisoning records around June 23, 2026, coinciding with a 'Summer Sale' promotional notice used as the lure/trigger banner. The injected payload broke out of the id attribute using an onanimationstart event handler paired with a CSS animation that fires within 10ms of page load, so it executes silently as soon as an authenticated wp-admin page renders. The handler's argument is eval(String.fromCharCode(...)) — a decimal-character-code-encoded loader that fetches a primary payload, w2.js, from the attacker's C2 at ia-cdn.com/fz/c.

w2.js extracts a valid WordPress REST/admin-ajax nonce from the current admin session's DOM and uses it to create a new administrator account through whichever of the REST API, the admin-ajax endpoint, or the user-new.php form succeeds first — effectively riding the logged-in admin's own authenticated session rather than stealing credentials. It then downloads and installs a fake plugin (observed slug wp-smart-thumbnails) that contains a webshell (emer-run.php) for remote command execution, and drops three files into wp-content/mu-plugins/ (which WordPress auto-loads on every request, guaranteeing persistence without needing to be 'activated'): class-wp-token-validate.php implements a 'magic login' backdoor that grants unauthenticated admin access via a ?_wplogin=<token> URL parameter and stores its tokens in the fz_emer_login_tokens wp_options row; class-wp-query-9d127ff3.php manipulates database queries to hide the rogue account from the WordPress user-list UI; and wp-cache-optimizer.php acts as a health-check/heartbeat module. All three files were backdated to September 2025 to blend in with legitimate file timestamps, and a fz_emer_done_v1 option flags hosts where the compromise chain completed. An alternate payload, x.js, generates deterministic rogue credentials from a hash of the victim's hostname (username pattern bd_[6-character hash], password pattern Bd@26![hash]x, with an @wordpress.org-style email), and results are exfiltrated back to the operators via navigator.sendBeacon.

Wordfence pushed malware signatures and WAF rules to paying customers on August 7, 2026 (free-tier users receive them after the standard 30-day delay); the poisoned API endpoints on api.sigmative.io were cleaned by BdThemes/the infrastructure operator on August 8, 2026, and the affected plugins were closed on the WordPress.org repository pending review. No CVE has been assigned. The Wordfence PSA states this activity shares operator characteristics with the Advanced Responsive Video Embedder (CVE-2026-18072, detected July 28, 2026) and OptinMonster/TrustPulse/PushEngage (Sansec/Patchstack, mid-June 2026) WordPress supply-chain campaigns from the preceding two months, though a follow-up review of the OptinMonster incident found no independently confirmed infrastructure or code overlap between that campaign and this one — the link should be treated as an unconfirmed operator hypothesis, not established attribution. Because the compromise runs entirely client-side in the admin's browser and requires no direct access to the target site, it silently achieves persistence at scale across every WordPress install running an affected plugin with the poisoned feed enabled.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1070.006 Timestomp; T1564 Hide Artifacts

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Initial Access

T1195.002 Compromise Software Supply Chain

defense-impairment

T1556 Modify Authentication Process

Resource Development

T1584 Compromise Infrastructure; T1608.001 Upload Malware

Remediation for BdThemes DigitalOcean Spaces feed

Patches

• No CVE has been assigned and no vendor code patch was published at time of reporting; BdThemes plugins were closed on the WordPress.org repository pending review as of 2026-08-07
• The underlying poisoned API endpoints on api.sigmative.io were cleaned/remediated by 2026-08-08, which stops new infections but does not remove backdoors already planted on compromised sites

Immediate actions

• Audit all WordPress administrator accounts for unrecognized entries, especially usernames matching the bd_[6-character hash] pattern or emails on @wordpress.org / @developer.wordpress.org domains, and remove any that were not created by site staff
• Search wp-content/mu-plugins/ for class-wp-token-validate.php, class-wp-query-9d127ff3.php, and wp-cache-optimizer.php and remove them immediately (mu-plugins auto-execute on every request with no 'active' toggle to check)
• Search the site for a webshell file named emer-run.php and for a plugin directory named wp-smart-thumbnails (or similarly generic names) and remove them
• Query the wp_options table for the fz_emer_login_tokens and fz_emer_done_v1 rows and delete them to invalidate any outstanding magic-login tokens
• Rotate WordPress secret keys/salts and force-logout all sessions after cleanup, since the attack rode an authenticated admin's live nonce

Workarounds

• Block outbound requests to ia-cdn.com and api.sigmative.io at the network edge / WAF while awaiting a vendor fix
• Temporarily deactivate the seven affected BdThemes plugins on any site where the promotional feed cannot be blocked at the network layer

Longer-term hardening

• Update the seven affected BdThemes plugins (Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant) once BdThemes ships a fix that removes or properly escapes the promotional-banner feed
• Deploy a WordPress firewall with active malware-signature coverage (e.g. Wordfence Premium/Care/Response) so future supply-chain-delivered payloads are caught even without a plugin-code review
• File-integrity-monitor wp-content/mu-plugins/ specifically, since it is a common vector for this class of self-persisting WordPress backdoor
• Treat any third-party promotional/telemetry/update-check API a plugin calls as part of that plugin's trust boundary — vendors should sign or checksum such feeds rather than trusting the response to be safe HTML/JSON

Affected and fixed versions

• BdThemes — Element Pack Addons for Elementor (bdthemes-element-pack-lite / bdthemes-element-pack)
  Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
• BdThemes — Prime Slider Addons for Elementor (bdthemes-prime-slider-lite)
  Vulnerable versions: 4.1.9 and later (XSS flaw introduced 2026-03-01)
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
• BdThemes — Pixel Gallery Addons for Elementor (pixel-gallery)
  Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
• BdThemes — Ultimate Post Kit (ultimate-post-kit)
  Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
• BdThemes — Ultimate Store Kit (ultimate-store-kit)
  Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
• BdThemes — Live Copy Paste (live-copy-paste)
  Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
• BdThemes — Smart Admin Assistant (smart-admin-assistant)
  Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
  Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07

Timeline of BdThemes DigitalOcean Spaces feed

• 2026-03-01 The unescaped display_id XSS flaw is introduced into the shared Biggopti promotional-banner component with Prime Slider Addons for Elementor v4.1.9.
• 2026-06-23 Poisoned-record timestamps on the promotional API feed indicate the malicious campaign begins, using a 'Summer Sale' promotional notice as the trigger banner.
• 2026-08-06 Last observed modifications to the poisoned locked-ioc-16 endpoints before discovery.
• 2026-08-07 Wordfence ships malware signatures and WAF rules to Premium, Care, Response, and paid CLI customers; free-tier users are scheduled to receive coverage after the standard 30-day delay.
• 2026-08-07 The Wordfence Threat Intelligence Team is notified of the supply chain compromise; the affected BdThemes plugins are closed on the WordPress.org repository pending review.
• 2026-08-08 The malicious API endpoints on locked-ioc-16 are cleaned, stopping new infections (already-planted backdoors on compromised sites remain until manually removed).
• 2026-08-10 Cyber Security News publishes public reporting summarizing the campaign, the affected plugin list, and remediation steps.

Sources cited for BdThemes DigitalOcean Spaces feed

• PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response wordfence.com · Advisory · 2026-08-07
• PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response (mirror) malware.news · Research · 2026-08-07
• Prime Slider – Addons for Elementor (Wordfence Threat Intel plugin profile) wordfence.com · Vendor report · 2026-08-07
• Element Pack – Widgets, Templates & Addons for Elementor (WPScan vulnerability database) wpscan.com · Vendor report · 2026-08-10
• Supply Chain Attack on OptinMonster, TrustPulse, and PushEngage: Tampered CDN Scripts Auto-Creating Rogue Admins patchstack.com · Research · 2026-06-15
• WordPress Supply Chain Attack cybersecuritynews.com · News · 2026-08-10

Threats related to BdThemes DigitalOcean Spaces feed

• BdThemes WordPress Plugin Supply-Chain Attack Poisons API to Create Rogue Admins
• Critical Avada WordPress Theme Flaw (CVE-2026-18431) Enables Zero-Click RCE
• wp2shell RCE Chain in WordPress Core (CVE-2026-60137, CVE-2026-63030) — Emergency Patch Released

Related coverage of this activity

• Operation Lunar Peek Sliver C2

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages