BdThemes WordPress Plugin Supply-Chain Attack Poisons API to Create Rogue Admins

Key facts for BdThemes API Poisoning Attack

Detection coverage for BdThemes API Poisoning Attack

As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1978 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop

Detects creation of WordPress administrator accounts matching the deterministic bd_<6-char base36> username pattern or spoofed @wordpress.org / @developer.wordpress.org email, and/or file drops matching the known emer-run.php webshell (dropped via the disguised wp-smart-thumbnails plugin) and the mu-plugin backdoor set (class-wp-token-validate.php, class-wp-query-*.php, wp-cache-optimizer.php) by filename or MD5.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1136, T1078, T1505.003, T1027, T1564
• Data sources: wordpress_rest_api_audit_log, web_access_logs, file_integrity_monitoring, edr_file_events
• Severity: critical
• Confidence: high

Splunk SPL

(index=web sourcetype=access_combined uri_path="/wp-json/wp/v2/users" method=POST status=201)
OR (index=wordpress_audit sourcetype=wp_user_created (new_user_login="bd_*" OR new_user_email="*@wordpress.org" OR new_user_email="*@developer.wordpress.org"))
OR ((index=fim OR index=edr) md5 IN ("1024732009983dd5e54b4cf5593f04d4","7719cd98a35ffad2771f26d1ceab7d27","9aadc3e5c5242b273bd17c5bdc358845","e450ae5bc4bfc0d960dded06a76bb8e9"))
OR ((index=fim OR index=edr) (file_name="emer-run.php" OR file_path="*/wp-content/plugins/wp-smart-thumbnails/*" OR file_path="*/wp-content/mu-plugins/class-wp-token-validate.php" OR file_path="*/wp-content/mu-plugins/class-wp-query-*.php" OR file_path="*/wp-content/mu-plugins/wp-cache-optimizer.php"))
| eval detection_reason=case(
    match(uri_path, "wp-json/wp/v2/users"), "rest_api_user_creation",
    isnotnull(new_user_login), "rogue_admin_username_bd_prefix_or_spoofed_email",
    isnotnull(md5), "known_ioc_file_hash_match",
    1=1, "known_backdoor_filename_or_path")
| table _time, host, src_ip, new_user_login, new_user_email, uri_path, file_name, file_path, md5, detection_reason
| sort - _time

Microsoft KQL

let KnownHashes = dynamic(["1024732009983dd5e54b4cf5593f04d4","7719cd98a35ffad2771f26d1ceab7d27","9aadc3e5c5242b273bd17c5bdc358845","e450ae5bc4bfc0d960dded06a76bb8e9"]);
let KnownPaths = dynamic(["emer-run.php","wp-smart-thumbnails","class-wp-token-validate.php","class-wp-query-","wp-cache-optimizer.php"]);
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where MD5 in (KnownHashes) or FileName has_any (KnownPaths) or FolderPath has_any (KnownPaths)
| project TimeGenerated, DeviceName, FileName, FolderPath, MD5, InitiatingProcessAccountName
| union (
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where RequestURL has "/wp-json/wp/v2/users" and RequestMethod == "POST"
    | project TimeGenerated, DeviceName=DestinationHostName, FileName=strcat(""), FolderPath=RequestURL, MD5=strcat(""), InitiatingProcessAccountName=SourceUserName
)
| order by TimeGenerated desc

Sigma

title: BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop
id: 3c4d5e6f-7a8b-49c0-9d1e-2f3a4b5c6d7e
status: experimental
description: Detects creation of WordPress administrator accounts with the bd_ deterministic username pattern or @wordpress.org/@developer.wordpress.org spoofed email, and/or file drops matching the known emer-run.php webshell and mu-plugin backdoor set (class-wp-token-validate.php, class-wp-query-*.php, wp-cache-optimizer.php).
references:
    - https://wordfence.com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response
    - https://gbhackers.com/wordpress-supply-chain-attack-exploits-bdthemes-plugins/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-10
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1556
    - attack.privilege-escalation
    - attack.t1078
    - attack.defense-evasion
    - attack.t1027
    - attack.t1564
    - attack.tool.emer_run
logsource:
    category: file_event
    definition: Requires file integrity monitoring or EDR file-creation telemetry on the WordPress webroot, plus WordPress REST API / audit-log ingestion for user-creation events
detection:
    selection_hash:
        Hashes|contains:
            - '1024732009983dd5e54b4cf5593f04d4'
            - '7719cd98a35ffad2771f26d1ceab7d27'
            - '9aadc3e5c5242b273bd17c5bdc358845'
            - 'e450ae5bc4bfc0d960dded06a76bb8e9'
    selection_filename:
        TargetFilename|contains:
            - 'emer-run.php'
            - 'wp-smart-thumbnails'
            - 'class-wp-token-validate.php'
            - 'class-wp-query-'
            - 'wp-cache-optimizer.php'
    condition: selection_hash or selection_filename
falsepositives:
    - Legitimate plugin coincidentally named wp-smart-thumbnails or a coincidental mu-plugin filename collision (low probability given the exact MD5 match requirement)
    - Bulk user-import/migration tooling creating admin accounts via the REST API for legitimate onboarding
level: critical

Known false positives:

• A legitimate plugin coincidentally named wp-smart-thumbnails or a coincidental mu-plugin filename collision (low probability given the exact MD5 match requirement)
• Bulk user-import tools or migration scripts creating admin accounts via the REST API for legitimate onboarding

Tuning notes: Feed the four published MD5 hashes and the bd_<6-char base36> username regex into a scheduled hunt in addition to real-time alerting; extend the mu-plugins path list if BdThemes/Sigmative or Wordfence publish updated backdoor variants, and require the file-hash or filename match (not the REST API call alone) before treating the alert as critical to avoid flooding on legitimate admin onboarding.

• 🔒 BdThemes Biggopti Poisoned API / Malicious Payload Retrieval · unlock with TL Creds
• 🔒 BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop · unlock with TL Creds
• 🔒 BdThemes Magic-Login Backdoor Use and [indicator] C2 Beacon · unlock with TL Creds
• 🔒 BdThemes Biggopti Poisoned API / Malicious Payload Retrieval · unlock with TL Creds
• 🔒 BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop · unlock with TL Creds
• 🔒 BdThemes Magic-Login Backdoor Use and [indicator] C2 Beacon · unlock with TL Creds
• 🔒 BdThemes Biggopti Poisoned API / Malicious Payload Retrieval · unlock with TL Creds
• 🔒 BdThemes Magic-Login Backdoor Use and [indicator] C2 Beacon · unlock with TL Creds

Indicators of compromise for BdThemes API Poisoning Attack

As of 2026-08-10, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-1978.

Sample indicators (3 of 17)

• Domain: ia-cdn[.]com
• File hash: 1024732009983dd5e54b4cf5593f04d4
• Domain: api[.]sigmative[.]io

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How BdThemes API Poisoning Attack works

BdThemes plugins ship an internal component named Biggopti that fetches promotional banner data from the Sigmative API (api.sigmative.io, Sigmative being BdThemes' parent company) on every authenticated wp-admin page load. The banner-rendering code concatenates the JSON response's display_id field directly into an HTML id attribute — `var f = t.display_id || t.id || "default"` — without escaping, even though a neighboring field in the same code path is properly HTML-escaped. This attribute-injection XSS (CVSS 5.4) was introduced in Prime Slider version 4.1.9 on March 1, 2026 (SVN revision r3471891) and shipped, via the shared Biggopti library, into Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant. On May 10, 2026 the endpoint moved to api-data-all-records and a DOMParser-based sanitizer was added elsewhere in the same code path, but the vulnerable id attribute itself was never fixed.

Separately from the code-level bug, attackers obtained write access to the DigitalOcean Spaces object storage bucket (fronted by Cloudflare) that backs the Sigmative/Biggopti API and began poisoning the JSON responses served from api.sigmative.io/prod/store/api/biggopti/api-data-all-records and the legacy api-data-records endpoint. The earliest poisoned record — a fake 'Summer Sale' promotional notice — carries a timestamp of June 23, 2026, indicating the live-exploitation window began then, though the vulnerable code had been shippable since March. A crafted display_id value closes the HTML attribute early and appends an onanimationstart event handler wrapping an eval(String.fromCharCode(...)) payload, which fires within roughly 10 milliseconds of the banner rendering in a logged-in administrator's browser — no click or interaction required.

The injected script (served as a secondary payload, api.sigmative.io/prod/store/api/biggopti/x.js, and a primary payload hosted on attacker infrastructure at ia-cdn.com/fz/w2.js) uses the WordPress REST API or the standard admin-creation workflow to provision a new administrator account with a deterministic username (bd_ followed by a 6-character base36 value derived from the victim's hostname) and password (format Bd@26!<hash>x). The script then uploads a disguised plugin — observed under harmless-sounding slugs such as wp-smart-thumbnails — that drops the emer-run.php webshell (MD5 1024732009983dd5e54b4cf5593f04d4) for direct remote command execution, plus three files planted as WordPress must-use (mu-plugins, which auto-load with no activation step or visibility in the plugins list) for persistence and stealth: class-wp-token-validate.php (MD5 7719cd98a35ffad2771f26d1ceab7d27), which implements a magic-login backdoor granting unauthenticated administrator access via a `?_wplogin=<token>` URL parameter validated against tokens stored in a new wp_options row named fz_emer_login_tokens; a stealth module following the naming pattern class-wp-query-*.php (MD5 9aadc3e5c5242b273bd17c5bdc358845) that rewrites WordPress database queries to hide the rogue accounts from the admin Users list; and wp-cache-optimizer.php (MD5 e450ae5bc4bfc0d960dded06a76bb8e9), a health-check/callback module. A wp_options flag named fz_emer_done_v1 marks a site as fully compromised so the payload does not re-run. Compromised sites also periodically beacon to an attacker-controlled C2 endpoint at ia-cdn.com/fz/c.

The Wordfence Threat Intelligence team was alerted to active exploitation on August 7, 2026 and shipped WAF detection signatures to paid customers the same day (free-tier users receive them after Wordfence's standard 30-day delay); the WordPress.org plugins team pulled all seven affected plugins from the public repository that same day. BdThemes/Sigmative cleaned the poisoned API responses on August 8, 2026. As of public disclosure on August 10, 2026, no software patch for the underlying display_id escaping bug has shipped and no CVE identifier has been assigned. Multiple outlets report that the C2 infrastructure overlaps with, and is attributed to the same actor behind, two other recent WordPress supply-chain compromises: the Advanced Responsive Video Embedder plugin backdoor (CVE-2026-18072, a hardcoded-token authentication bypass disclosed July 29, 2026) and the OptinMonster/TrustPulse/PushEngage CDN-tampering campaign (Awesome Motive, compromised CDN API key, active June 12-14, 2026, ~1.2-1.4 million sites exposed) — suggesting a single actor running a sustained campaign against WordPress plugin vendors' build/delivery infrastructure rather than a one-off incident.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1564 Hide Artifacts

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol

Privilege Escalation

T1078 Valid Accounts

Initial Access

T1195 Supply Chain Compromise

Persistence

T1505 Server Software Component; T1556 Modify Authentication Process

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities

Remediation for BdThemes API Poisoning Attack

Patches

• No vendor patch available as of 2026-08-10; all seven affected plugins were pulled from the WordPress.org repository on 2026-08-08 pending investigation

Immediate actions

• Deactivate and remove all affected BdThemes plugins (Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, Smart Admin Assistant) until a fix ships
• Audit the WordPress users table for accounts with usernames prefixed 'bd_' followed by a 6-character alphanumeric string, or emails at @wordpress.org / @developer.wordpress.org
• Search the filesystem for emer-run.php and any unfamiliar recently-installed plugin directories (observed disguised as e.g. wp-smart-thumbnails) and remove them
• Inspect wp-content/mu-plugins for unfamiliar files such as class-wp-token-validate.php, class-wp-query-*.php, and wp-cache-optimizer.php and delete them
• Query the wp_options table for fz_emer_login_tokens and fz_emer_done_v1 rows and remove them
• Block outbound requests to ia-cdn.com and treat api.sigmative.io responses as untrusted at the network/WAF layer pending vendor remediation
• Rotate all WordPress administrator credentials and force-terminate all active admin sessions

Workarounds

• Manually disable or firewall the Biggopti banner component's outbound API calls to api.sigmative.io until a fix ships

Longer-term hardening

• Deploy a WAF (e.g. Wordfence) with signature coverage for the Biggopti display_id XSS payload pattern
• Alert on unexpected outbound requests from wp-admin page loads to third-party promotional/banner API domains
• Treat vendor-hosted remote JSON/config feeds fetched by plugins as untrusted supply-chain input requiring integrity verification (e.g. subresource integrity, signed responses) rather than implicit trust

Affected and fixed versions

• BdThemes — Element Pack Addons for Elementor (bdthemes-element-pack-lite)
  Vulnerable versions: all versions bundling the Biggopti component as of August 2026 (100,000+ active installs)
• BdThemes — Prime Slider Addons for Elementor (bdthemes-prime-slider-lite)
  Vulnerable versions: >=4.1.9 (display_id XSS introduced March 1, 2026, SVN r3471891)
• BdThemes — Pixel Gallery Addons for Elementor (pixel-gallery)
  Vulnerable versions: all versions bundling the Biggopti component
• BdThemes — Ultimate Post Kit (ultimate-post-kit)
  Vulnerable versions: all versions bundling the Biggopti component
• BdThemes — Ultimate Store Kit (ultimate-store-kit)
  Vulnerable versions: all versions bundling the Biggopti component
• BdThemes — Live Copy Paste for Elementor (live-copy-paste)
  Vulnerable versions: all versions bundling the Biggopti component
• BdThemes — Smart Admin Assistant (smart-admin-assistant)
  Vulnerable versions: all versions bundling the Biggopti component

Timeline of BdThemes API Poisoning Attack

• 2026-03-01 Biggopti display_id attribute-injection XSS introduced in Prime Slider v4.1.9 (SVN r3471891); ships to all plugins sharing the Biggopti library.
• 2026-05-10 Sigmative API endpoint changes to api-data-all-records and a DOMParser-based sanitizer is added elsewhere in the code path, but the vulnerable display_id-to-id-attribute concatenation is left unfixed.
• 2026-06-23 Earliest poisoned promotional record (a fake 'Summer Sale' notice) observed in the Biggopti JSON feed, marking the start of live exploitation.
• 2026-08-06 Final round of poisoned JSON modifications made to the locked-ioc-14 Biggopti endpoints before detection.
• 2026-08-07 Wordfence Threat Intelligence is alerted to active exploitation via its WAF; detection signatures ship to paid Wordfence customers same-day and the WordPress.org plugins team pulls all seven affected plugins from the public repository.
• 2026-08-08 BdThemes/Sigmative cleans the poisoned API endpoints, which begin returning benign JSON; no plugin code patch is released.
• 2026-08-10 Public disclosure via BleepingComputer and other outlets; no CVE assigned and no software fix available, plugins remain removed from the WordPress.org repository.

Sources cited for BdThemes API Poisoning Attack

• PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response wordfence.com · Advisory · 2026-08-07
• Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick — CVE-2026-18072 GitHub · Advisory · 2026-07-29
• WordPress Supply Chain Attack Exploits BdThemes Plugins to Create Rogue Admin Accounts and Install Webshells gbhackers.com · Research · 2026-08-08
• BDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys Webshells cyberpress.org · Research · 2026-08-08
• New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response cybersecuritynews.com · Research · 2026-08-08
• PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response (repost) malware.news · Research · 2026-08-07
• BdThemes plugins supply-chain hack creates rogue WordPress admins BleepingComputer · News · 2026-08-10
• WordPress Plugins Compromised Without a Single File Change infosecurity-magazine.com · News · 2026-08-08

Threats related to BdThemes API Poisoning Attack

• WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages