WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)
WordPress Supply Chain Attack via BdThemes Promotional API (TL-2026-1971) is a high-severity supply-chain compromise scored CVSS 5.4, first published 2026-08-10. It has no confirmed attribution, affects BdThemes Element Pack Addons for Elementor (bdthemes-element-pack-lite, maps to 11 MITRE ATT&CK techniques (T1027, T1059.007, T1070.006), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1971
- Threat ID
- TL-2026-1971
- Severity
- HIGH
- CVSS
- 5.4
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 20
Attackers compromised the DigitalOcean Spaces-hosted promotional API feed shared by seven BdThemes WordPress plugins, injecting an unescaped display_id field that broke out of an HTML id attribute to run arbitrary JavaScript in the browsers of logged-in administrators. The script stole the admin's active REST nonce to create a rogue administrator account, dropped a webshell via a fake plugin, and installed three must-use-plugin backdoors for persistent, unauthenticated access.
How WordPress Supply Chain Attack via BdThemes Promotional API works
On August 7, 2026 the Wordfence Threat Intelligence Team was notified of a supply chain compromise affecting the BdThemes WordPress plugin ecosystem. Seven BdThemes plugins — Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant — share a 'Biggopti' component that fetches promotional banner data from a static JSON feed hosted on a DigitalOcean Spaces bucket (fronted by Cloudflare) at api.sigmative.io. A cross-site scripting flaw tracked with CVSS 5.4, introduced March 1, 2026 in Prime Slider v4.1.9, left the feed's display_id field concatenated directly into an HTML id attribute without escaping, while every other field in the same response was properly sanitized.
Attackers who gained control of the feed (indicating compromised cloud storage or vendor API credentials, not a bug in the plugins' own escaping logic for other fields) began poisoning records around June 23, 2026, coinciding with a 'Summer Sale' promotional notice used as the lure/trigger banner. The injected payload broke out of the id attribute using an onanimationstart event handler paired with a CSS animation that fires within 10ms of page load, so it executes silently as soon as an authenticated wp-admin page renders. The handler's argument is eval(String.fromCharCode(...)) — a decimal-character-code-encoded loader that fetches a primary payload, w2.js, from the attacker's C2 at ia-cdn.com/fz/c.
w2.js extracts a valid WordPress REST/admin-ajax nonce from the current admin session's DOM and uses it to create a new administrator account through whichever of the REST API, the admin-ajax endpoint, or the user-new.php form succeeds first — effectively riding the logged-in admin's own authenticated session rather than stealing credentials. It then downloads and installs a fake plugin (observed slug wp-smart-thumbnails) that contains a webshell (emer-run.php) for remote command execution, and drops three files into wp-content/mu-plugins/ (which WordPress auto-loads on every request, guaranteeing persistence without needing to be 'activated'): class-wp-token-validate.php implements a 'magic login' backdoor that grants unauthenticated admin access via a ?_wplogin=<token> URL parameter and stores its tokens in the fz_emer_login_tokens wp_options row; class-wp-query-9d127ff3.php manipulates database queries to hide the rogue account from the WordPress user-list UI; and wp-cache-optimizer.php acts as a health-check/heartbeat module. All three files were backdated to September 2025 to blend in with legitimate file timestamps, and a fz_emer_done_v1 option flags hosts where the compromise chain completed. An alternate payload, x.js, generates deterministic rogue credentials from a hash of the victim's hostname (username pattern bd_[6-character hash], password pattern Bd@26![hash]x, with an @wordpress.org-style email), and results are exfiltrated back to the operators via navigator.sendBeacon.
Wordfence pushed malware signatures and WAF rules to paying customers on August 7, 2026 (free-tier users receive them after the standard 30-day delay); the poisoned API endpoints on api.sigmative.io were cleaned by BdThemes/the infrastructure operator on August 8, 2026, and the affected plugins were closed on the WordPress.org repository pending review. No CVE has been assigned. The Wordfence PSA states this activity shares operator characteristics with the Advanced Responsive Video Embedder (CVE-2026-18072, detected July 28, 2026) and OptinMonster/TrustPulse/PushEngage (Sansec/Patchstack, mid-June 2026) WordPress supply-chain campaigns from the preceding two months, though a follow-up review of the OptinMonster incident found no independently confirmed infrastructure or code overlap between that campaign and this one — the link should be treated as an unconfirmed operator hypothesis, not established attribution. Because the compromise runs entirely client-side in the admin's browser and requires no direct access to the target site, it silently achieves persistence at scale across every WordPress install running an affected plugin with the poisoned feed enabled.
MITRE ATT&CK techniques used in TL-2026-1971
Defense Evasion
T1027 Obfuscated Files or Information; T1070.006 Timestomp; T1564 Hide Artifacts
Execution
Command and Control
Persistence
T1136.001 Local Account; T1505.003 Web Shell
Initial Access
T1195.002 Compromise Software Supply Chain
defense-impairment
T1556 Modify Authentication Process
Resource Development
Affected products and versions in WordPress Supply Chain Attack via BdThemes Promotional API
- BdThemes — Element Pack Addons for Elementor (bdthemes-element-pack-lite / bdthemes-element-pack)
Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07 - BdThemes — Prime Slider Addons for Elementor (bdthemes-prime-slider-lite)
Vulnerable versions: 4.1.9 and later (XSS flaw introduced 2026-03-01)
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07 - BdThemes — Pixel Gallery Addons for Elementor (pixel-gallery)
Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07 - BdThemes — Ultimate Post Kit (ultimate-post-kit)
Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07 - BdThemes — Ultimate Store Kit (ultimate-store-kit)
Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07 - BdThemes — Live Copy Paste (live-copy-paste)
Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07 - BdThemes — Smart Admin Assistant (smart-admin-assistant)
Vulnerable versions: versions using the poisoned Biggopti promotional feed; exact range not disclosed
Fixed in: not disclosed — plugin closed on WordPress.org pending vendor review as of 2026-08-07
Remediation for WordPress Supply Chain Attack via BdThemes Promotional API
Patches
- No CVE has been assigned and no vendor code patch was published at time of reporting; BdThemes plugins were closed on the WordPress.org repository pending review as of 2026-08-07
- The underlying poisoned API endpoints on api.sigmative.io were cleaned/remediated by 2026-08-08, which stops new infections but does not remove backdoors already planted on compromised sites
Immediate actions
- Audit all WordPress administrator accounts for unrecognized entries, especially usernames matching the bd_[6-character hash] pattern or emails on @wordpress.org / @developer.wordpress.org domains, and remove any that were not created by site staff
- Search wp-content/mu-plugins/ for class-wp-token-validate.php, class-wp-query-9d127ff3.php, and wp-cache-optimizer.php and remove them immediately (mu-plugins auto-execute on every request with no 'active' toggle to check)
- Search the site for a webshell file named emer-run.php and for a plugin directory named wp-smart-thumbnails (or similarly generic names) and remove them
- Query the wp_options table for the fz_emer_login_tokens and fz_emer_done_v1 rows and delete them to invalidate any outstanding magic-login tokens
- Rotate WordPress secret keys/salts and force-logout all sessions after cleanup, since the attack rode an authenticated admin's live nonce
Workarounds
- Block outbound requests to ia-cdn.com and api.sigmative.io at the network edge / WAF while awaiting a vendor fix
- Temporarily deactivate the seven affected BdThemes plugins on any site where the promotional feed cannot be blocked at the network layer
Longer-term hardening
- Update the seven affected BdThemes plugins (Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant) once BdThemes ships a fix that removes or properly escapes the promotional-banner feed
- Deploy a WordPress firewall with active malware-signature coverage (e.g. Wordfence Premium/Care/Response) so future supply-chain-delivered payloads are caught even without a plugin-code review
- File-integrity-monitor wp-content/mu-plugins/ specifically, since it is a common vector for this class of self-persisting WordPress backdoor
- Treat any third-party promotional/telemetry/update-check API a plugin calls as part of that plugin's trust boundary — vendors should sign or checksum such feeds rather than trusting the response to be safe HTML/JSON
Weaknesses (CWE) in WordPress Supply Chain Attack via BdThemes Promotional API
CWE-79
Timeline of WordPress Supply Chain Attack via BdThemes Promotional API
- The unescaped display_id XSS flaw is introduced into the shared Biggopti promotional-banner component with Prime Slider Addons for Elementor v4.1.9.
- Poisoned-record timestamps on the promotional API feed indicate the malicious campaign begins, using a 'Summer Sale' promotional notice as the trigger banner.
- Last observed modifications to the poisoned api.sigmative.io endpoints before discovery.
- Wordfence ships malware signatures and WAF rules to Premium, Care, Response, and paid CLI customers; free-tier users are scheduled to receive coverage after the standard 30-day delay.
- The Wordfence Threat Intelligence Team is notified of the supply chain compromise; the affected BdThemes plugins are closed on the WordPress.org repository pending review.
- The malicious API endpoints on api.sigmative.io are cleaned, stopping new infections (already-planted backdoors on compromised sites remain until manually removed).
- Cyber Security News publishes public reporting summarizing the campaign, the affected plugin list, and remediation steps.
Sources cited for WordPress Supply Chain Attack via BdThemes Promotional API
- WordPress Supply Chain Attack
- PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
- PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response (mirror)
- Prime Slider – Addons for Elementor (Wordfence Threat Intel plugin profile)
- Element Pack – Widgets, Templates & Addons for Elementor (WPScan vulnerability database)
- Supply Chain Attack on OptinMonster, TrustPulse, and PushEngage: Tampered CDN Scripts Auto-Creating Rogue Admins
Threats related to WordPress Supply Chain Attack via BdThemes Promotional API
Detection coverage for TL-2026-1971
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1971 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.