BdThemes WordPress Plugin Supply-Chain Attack Poisons API to Create Rogue Admins
BdThemes WordPress Plugin Supply-Chain Attack Poisons API to (TL-2026-1978) is a medium-severity supply-chain compromise scored CVSS 5.4, first published 2026-08-10. It has no confirmed attribution, affects BdThemes Element Pack Addons for Elementor, maps to 11 MITRE ATT&CK techniques (T1027, T1059, T1071), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1978
- Threat ID
- TL-2026-1978
- Severity
- MEDIUM
- CVSS
- 5.4
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 17
Attackers who gained write access to BdThemes' DigitalOcean Spaces storage bucket poisoned the static JSON feed consumed by the 'Biggopti' promotional-banner component bundled across seven BdThemes/Sigmative Elementor addon plugins (350,000+ combined installs). A previously unescaped 'display_id' field (introduced March 1, 2026 in Prime Slider v4.1.9) let the poisoned JSON inject an onanimationstart-triggered script into every wp-admin page load, silently creating rogue 'bd_' administrator accounts, dropping the emer-run.php webshell via a fake plugin, and installing an unauthenticated magic-login backdoor.
How BdThemes WordPress Plugin Supply-Chain Attack Poisons API to works
BdThemes plugins ship an internal component named Biggopti that fetches promotional banner data from the Sigmative API (api.sigmative.io, Sigmative being BdThemes' parent company) on every authenticated wp-admin page load. The banner-rendering code concatenates the JSON response's display_id field directly into an HTML id attribute — `var f = t.display_id || t.id || "default"` — without escaping, even though a neighboring field in the same code path is properly HTML-escaped. This attribute-injection XSS (CVSS 5.4) was introduced in Prime Slider version 4.1.9 on March 1, 2026 (SVN revision r3471891) and shipped, via the shared Biggopti library, into Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant. On May 10, 2026 the endpoint moved to api-data-all-records and a DOMParser-based sanitizer was added elsewhere in the same code path, but the vulnerable id attribute itself was never fixed.
Separately from the code-level bug, attackers obtained write access to the DigitalOcean Spaces object storage bucket (fronted by Cloudflare) that backs the Sigmative/Biggopti API and began poisoning the JSON responses served from api.sigmative.io/prod/store/api/biggopti/api-data-all-records and the legacy api-data-records endpoint. The earliest poisoned record — a fake 'Summer Sale' promotional notice — carries a timestamp of June 23, 2026, indicating the live-exploitation window began then, though the vulnerable code had been shippable since March. A crafted display_id value closes the HTML attribute early and appends an onanimationstart event handler wrapping an eval(String.fromCharCode(...)) payload, which fires within roughly 10 milliseconds of the banner rendering in a logged-in administrator's browser — no click or interaction required.
The injected script (served as a secondary payload, api.sigmative.io/prod/store/api/biggopti/x.js, and a primary payload hosted on attacker infrastructure at ia-cdn.com/fz/w2.js) uses the WordPress REST API or the standard admin-creation workflow to provision a new administrator account with a deterministic username (bd_ followed by a 6-character base36 value derived from the victim's hostname) and password (format Bd@26!<hash>x). The script then uploads a disguised plugin — observed under harmless-sounding slugs such as wp-smart-thumbnails — that drops the emer-run.php webshell (MD5 1024732009983dd5e54b4cf5593f04d4) for direct remote command execution, plus three files planted as WordPress must-use (mu-plugins, which auto-load with no activation step or visibility in the plugins list) for persistence and stealth: class-wp-token-validate.php (MD5 7719cd98a35ffad2771f26d1ceab7d27), which implements a magic-login backdoor granting unauthenticated administrator access via a `?_wplogin=<token>` URL parameter validated against tokens stored in a new wp_options row named fz_emer_login_tokens; a stealth module following the naming pattern class-wp-query-*.php (MD5 9aadc3e5c5242b273bd17c5bdc358845) that rewrites WordPress database queries to hide the rogue accounts from the admin Users list; and wp-cache-optimizer.php (MD5 e450ae5bc4bfc0d960dded06a76bb8e9), a health-check/callback module. A wp_options flag named fz_emer_done_v1 marks a site as fully compromised so the payload does not re-run. Compromised sites also periodically beacon to an attacker-controlled C2 endpoint at ia-cdn.com/fz/c.
The Wordfence Threat Intelligence team was alerted to active exploitation on August 7, 2026 and shipped WAF detection signatures to paid customers the same day (free-tier users receive them after Wordfence's standard 30-day delay); the WordPress.org plugins team pulled all seven affected plugins from the public repository that same day. BdThemes/Sigmative cleaned the poisoned API responses on August 8, 2026. As of public disclosure on August 10, 2026, no software patch for the underlying display_id escaping bug has shipped and no CVE identifier has been assigned. Multiple outlets report that the C2 infrastructure overlaps with, and is attributed to the same actor behind, two other recent WordPress supply-chain compromises: the Advanced Responsive Video Embedder plugin backdoor (CVE-2026-18072, a hardcoded-token authentication bypass disclosed July 29, 2026) and the OptinMonster/TrustPulse/PushEngage CDN-tampering campaign (Awesome Motive, compromised CDN API key, active June 12-14, 2026, ~1.2-1.4 million sites exposed) — suggesting a single actor running a sustained campaign against WordPress plugin vendors' build/delivery infrastructure rather than a one-off incident.
MITRE ATT&CK techniques used in TL-2026-1978
Defense Evasion
T1027 Obfuscated Files or Information; T1564 Hide Artifacts
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Privilege Escalation
Initial Access
Persistence
T1505 Server Software Component; T1556 Modify Authentication Process
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities
Affected products and versions in BdThemes WordPress Plugin Supply-Chain Attack Poisons API to
- BdThemes — Element Pack Addons for Elementor (bdthemes-element-pack-lite)
Vulnerable versions: all versions bundling the Biggopti component as of August 2026 (100,000+ active installs) - BdThemes — Prime Slider Addons for Elementor (bdthemes-prime-slider-lite)
Vulnerable versions: >=4.1.9 (display_id XSS introduced March 1, 2026, SVN r3471891) - BdThemes — Pixel Gallery Addons for Elementor (pixel-gallery)
Vulnerable versions: all versions bundling the Biggopti component - BdThemes — Ultimate Post Kit (ultimate-post-kit)
Vulnerable versions: all versions bundling the Biggopti component - BdThemes — Ultimate Store Kit (ultimate-store-kit)
Vulnerable versions: all versions bundling the Biggopti component - BdThemes — Live Copy Paste for Elementor (live-copy-paste)
Vulnerable versions: all versions bundling the Biggopti component - BdThemes — Smart Admin Assistant (smart-admin-assistant)
Vulnerable versions: all versions bundling the Biggopti component
Remediation for BdThemes WordPress Plugin Supply-Chain Attack Poisons API to
Patches
- No vendor patch available as of 2026-08-10; all seven affected plugins were pulled from the WordPress.org repository on 2026-08-08 pending investigation
Immediate actions
- Deactivate and remove all affected BdThemes plugins (Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant) until a fix ships
- Audit the WordPress users table for accounts with usernames prefixed 'bd_' followed by a 6-character alphanumeric string, or emails at @wordpress.org / @developer.wordpress.org
- Search the filesystem for emer-run.php and any unfamiliar recently-installed plugin directories (observed disguised as e.g. wp-smart-thumbnails) and remove them
- Inspect wp-content/mu-plugins for unfamiliar files such as class-wp-token-validate.php, class-wp-query-*.php, and wp-cache-optimizer.php and delete them
- Query the wp_options table for fz_emer_login_tokens and fz_emer_done_v1 rows and remove them
- Block outbound requests to ia-cdn.com and treat api.sigmative.io responses as untrusted at the network/WAF layer pending vendor remediation
- Rotate all WordPress administrator credentials and force-terminate all active admin sessions
Workarounds
- Manually disable or firewall the Biggopti banner component's outbound API calls to api.sigmative.io until a fix ships
Longer-term hardening
- Deploy a WAF (e.g. Wordfence) with signature coverage for the Biggopti display_id XSS payload pattern
- Alert on unexpected outbound requests from wp-admin page loads to third-party promotional/banner API domains
- Treat vendor-hosted remote JSON/config feeds fetched by plugins as untrusted supply-chain input requiring integrity verification (e.g. subresource integrity, signed responses) rather than implicit trust
Weaknesses (CWE) in BdThemes WordPress Plugin Supply-Chain Attack Poisons API to
CWE-79, CWE-829, CWE-306
Timeline of BdThemes WordPress Plugin Supply-Chain Attack Poisons API to
- Biggopti display_id attribute-injection XSS introduced in Prime Slider v4.1.9 (SVN r3471891); ships to all plugins sharing the Biggopti library.
- Sigmative API endpoint changes to api-data-all-records and a DOMParser-based sanitizer is added elsewhere in the code path, but the vulnerable display_id-to-id-attribute concatenation is left unfixed.
- Earliest poisoned promotional record (a fake 'Summer Sale' notice) observed in the Biggopti JSON feed, marking the start of live exploitation.
- Final round of poisoned JSON modifications made to the api.sigmative.io Biggopti endpoints before detection.
- Wordfence Threat Intelligence is alerted to active exploitation via its WAF; detection signatures ship to paid Wordfence customers same-day and the WordPress.org plugins team pulls all seven affected plugins from the public repository.
- BdThemes/Sigmative cleans the poisoned API endpoints, which begin returning benign JSON; no plugin code patch is released.
- Public disclosure via BleepingComputer and other outlets; no CVE assigned and no software fix available, plugins remain removed from the WordPress.org repository.
Sources cited for BdThemes WordPress Plugin Supply-Chain Attack Poisons API to
- BdThemes plugins supply-chain hack creates rogue WordPress admins
- PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
- WordPress Supply Chain Attack Exploits BdThemes Plugins to Create Rogue Admin Accounts and Install Webshells
- BDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys Webshells
- New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response
- WordPress Plugins Compromised Without a Single File Change
- PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response (repost)
- Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick — CVE-2026-18072
Threats related to BdThemes WordPress Plugin Supply-Chain Attack Poisons API to
Detection coverage for TL-2026-1978
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1978 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.