# WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)

> Attackers compromised the DigitalOcean Spaces-hosted promotional API feed shared by seven BdThemes WordPress plugins, injecting an unescaped display_id field that broke out of an HTML id attribute to run arbitrary JavaScript in the browsers of logged-in administrators. The script stole the admin's active REST nonce to create a rogue administrator account, dropped a webshell via a fake plugin, and installed three must-use-plugin backdoors for persistent, unauthenticated access.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1971
- **ID:** TL-2026-1971
- **Severity:** HIGH (CVSS 5.4)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 7, 2026 the Wordfence Threat Intelligence Team was notified of a supply chain compromise affecting the BdThemes WordPress plugin ecosystem. Seven BdThemes plugins — Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant — share a 'Biggopti' component that fetches promotional banner data from a static JSON feed hosted on a DigitalOcean Spaces bucket (fronted by Cloudflare) at api.sigmative.io. A cross-site scripting flaw tracked with CVSS 5.4, introduced March 1, 2026 in Prime Slider v4.1.9, left the feed's display_id field concatenated directly into an HTML id attribute without escaping, while every other field in the same response was properly sanitized.

Attackers who gained control of the feed (indicating compromised cloud storage or vendor API credentials, not a bug in the plugins' own escaping logic for other fields) began poisoning records around June 23, 2026, coinciding with a 'Summer Sale' promotional notice used as the lure/trigger banner. The injected payload broke out of the id attribute using an onanimationstart event handler paired with a CSS animation that fires within 10ms of page load, so it executes silently as soon as an authenticated wp-admin page renders. The handler's argument is eval(String.fromCharCode(...)) — a decimal-character-code-encoded loader that fetches a primary payload, w2.js, from the attacker's C2 at ia-cdn.com/fz/c.

w2.js extracts a valid WordPress REST/admin-ajax nonce from the current admin session's DOM and uses it to create a new administrator account through whichever of the REST API, the admin-ajax endpoint, or the user-new.php form succeeds first — effectively riding the logged-in admin's own authenticated session rather than stealing credentials. It then downloads and installs a fake plugin (observed slug wp-smart-thumbnails) that contains a webshell (emer-run.php) for remote command execution, and drops three files into wp-content/mu-plugins/ (which WordPress auto-loads on every request, guaranteeing persistence without needing to be 'activated'): class-wp-token-validate.php implements a 'magic login' backdoor that grants unauthenticated admin access via a ?_wplogin=<token> URL parameter and stores its tokens in the fz_emer_login_tokens wp_options row; class-wp-query-9d127ff3.php manipulates database queries to hide the rogue account from the WordPress user-list UI; and wp-cache-optimizer.php acts as a health-check/heartbeat module. All three files were backdated to September 2025 to blend in with legitimate file timestamps, and a fz_emer_done_v1 option flags hosts where the compromise chain completed. An alternate payload, x.js, generates deterministic rogue credentials from a hash of the victim's hostname (username pattern bd_[6-character hash], password pattern Bd@26![hash]x, with an @wordpress.org-style email), and results are exfiltrated back to the operators via navigator.sendBeacon.

Wordfence pushed malware signatures and WAF rules to paying customers on August 7, 2026 (free-tier users receive them after the standard 30-day delay); the poisoned API endpoints on api.sigmative.io were cleaned by BdThemes/the infrastructure operator on August 8, 2026, and the affected plugins were closed on the WordPress.org repository pending review. No CVE has been assigned. The Wordfence PSA states this activity shares operator characteristics with the Advanced Responsive Video Embedder (CVE-2026-18072, detected July 28, 2026) and OptinMonster/TrustPulse/PushEngage (Sansec/Patchstack, mid-June 2026) WordPress supply-chain campaigns from the preceding two months, though a follow-up review of the OptinMonster incident found no independently confirmed infrastructure or code overlap between that campaign and this one — the link should be treated as an unconfirmed operator hypothesis, not established attribution. Because the compromise runs entirely client-side in the admin's browser and requires no direct access to the target site, it silently achieves persistence at scale across every WordPress install running an affected plugin with the poisoned feed enabled.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1136.001 Local Account
- T1505.003 Web Shell
- T1556 Modify Authentication Process
- T1564 Hide Artifacts
- T1070.006 Timestomp
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols

## Sources

- [WordPress Supply Chain Attack](https://cybersecuritynews.com/wordpress-supply-chain-attack/)
- [PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response](https://www.wordfence.com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response/)
- [PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response (mirror)](https://malware.news/t/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response/124607)
- [Prime Slider – Addons for Elementor (Wordfence Threat Intel plugin profile)](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bdthemes-prime-slider-lite)
- [Element Pack – Widgets, Templates & Addons for Elementor (WPScan vulnerability database)](https://wpscan.com/plugin/bdthemes-element-pack-lite/)
- [Supply Chain Attack on OptinMonster, TrustPulse, and PushEngage: Tampered CDN Scripts Auto-Creating Rogue Admins](https://patchstack.com/articles/supply-chain-attack-on-optinmonster-trustpulse-and-pushengage-tampered-cdn-scripts-auto-creating-rogue-admins/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1971