# BdThemes WordPress Plugin Supply-Chain Attack Poisons API to Create Rogue Admins

> Attackers who gained write access to BdThemes' DigitalOcean Spaces storage bucket poisoned the static JSON feed consumed by the 'Biggopti' promotional-banner component bundled across seven BdThemes/Sigmative Elementor addon plugins (350,000+ combined installs). A previously unescaped 'display_id' field (introduced March 1, 2026 in Prime Slider v4.1.9) let the poisoned JSON inject an onanimationstart-triggered script into every wp-admin page load, silently creating rogue 'bd_' administrator accounts, dropping the emer-run.php webshell via a fake plugin, and installing an unauthenticated magic-login backdoor.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1978
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-bdthemes-api-poisoning-attack-tl-2026-1978.webp?v=7e5c182b (Threadlinqs threat intel: BdThemes API Poisoning: Detection & IOCs (TL-2026-1978) — Medium severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-1978
- **Severity:** MEDIUM (CVSS 5.4)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

BdThemes plugins ship an internal component named Biggopti that fetches promotional banner data from the Sigmative API (api.sigmative.io, Sigmative being BdThemes' parent company) on every authenticated wp-admin page load. The banner-rendering code concatenates the JSON response's display_id field directly into an HTML id attribute — `var f = t.display_id || t.id || "default"` — without escaping, even though a neighboring field in the same code path is properly HTML-escaped. This attribute-injection XSS (CVSS 5.4) was introduced in Prime Slider version 4.1.9 on March 1, 2026 (SVN revision r3471891) and shipped, via the shared Biggopti library, into Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant. On May 10, 2026 the endpoint moved to api-data-all-records and a DOMParser-based sanitizer was added elsewhere in the same code path, but the vulnerable id attribute itself was never fixed.

Separately from the code-level bug, attackers obtained write access to the DigitalOcean Spaces object storage bucket (fronted by Cloudflare) that backs the Sigmative/Biggopti API and began poisoning the JSON responses served from api.sigmative.io/prod/store/api/biggopti/api-data-all-records and the legacy api-data-records endpoint. The earliest poisoned record — a fake 'Summer Sale' promotional notice — carries a timestamp of June 23, 2026, indicating the live-exploitation window began then, though the vulnerable code had been shippable since March. A crafted display_id value closes the HTML attribute early and appends an onanimationstart event handler wrapping an eval(String.fromCharCode(...)) payload, which fires within roughly 10 milliseconds of the banner rendering in a logged-in administrator's browser — no click or interaction required.

The injected script (served as a secondary payload, api.sigmative.io/prod/store/api/biggopti/x.js, and a primary payload hosted on attacker infrastructure at ia-cdn.com/fz/w2.js) uses the WordPress REST API or the standard admin-creation workflow to provision a new administrator account with a deterministic username (bd_ followed by a 6-character base36 value derived from the victim's hostname) and password (format Bd@26!<hash>x). The script then uploads a disguised plugin — observed under harmless-sounding slugs such as wp-smart-thumbnails — that drops the emer-run.php webshell (MD5 1024732009983dd5e54b4cf5593f04d4) for direct remote command execution, plus three files planted as WordPress must-use (mu-plugins, which auto-load with no activation step or visibility in the plugins list) for persistence and stealth: class-wp-token-validate.php (MD5 7719cd98a35ffad2771f26d1ceab7d27), which implements a magic-login backdoor granting unauthenticated administrator access via a `?_wplogin=<token>` URL parameter validated against tokens stored in a new wp_options row named fz_emer_login_tokens; a stealth module following the naming pattern class-wp-query-*.php (MD5 9aadc3e5c5242b273bd17c5bdc358845) that rewrites WordPress database queries to hide the rogue accounts from the admin Users list; and wp-cache-optimizer.php (MD5 e450ae5bc4bfc0d960dded06a76bb8e9), a health-check/callback module. A wp_options flag named fz_emer_done_v1 marks a site as fully compromised so the payload does not re-run. Compromised sites also periodically beacon to an attacker-controlled C2 endpoint at ia-cdn.com/fz/c.

The Wordfence Threat Intelligence team was alerted to active exploitation on August 7, 2026 and shipped WAF detection signatures to paid customers the same day (free-tier users receive them after Wordfence's standard 30-day delay); the WordPress.org plugins team pulled all seven affected plugins from the public repository that same day. BdThemes/Sigmative cleaned the poisoned API responses on August 8, 2026. As of public disclosure on August 10, 2026, no software patch for the underlying display_id escaping bug has shipped and no CVE identifier has been assigned. Multiple outlets report that the C2 infrastructure overlaps with, and is attributed to the same actor behind, two other recent WordPress supply-chain compromises: the Advanced Responsive Video Embedder plugin backdoor (CVE-2026-18072, a hardcoded-token authentication bypass disclosed July 29, 2026) and the OptinMonster/TrustPulse/PushEngage CDN-tampering campaign (Awesome Motive, compromised CDN API key, active June 12-14, 2026, ~1.2-1.4 million sites exposed) — suggesting a single actor running a sustained campaign against WordPress plugin vendors' build/delivery infrastructure rather than a one-off incident.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1584 Compromise Infrastructure
- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1556 Modify Authentication Process
- T1078 Valid Accounts
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1071 Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop** (`TL-2026-1978-SPL-002`)

Detects creation of WordPress administrator accounts matching the deterministic bd_<6-char base36> username pattern or spoofed @wordpress.org / @developer.wordpress.org email, and/or file drops matching the known emer-run.php webshell (dropped via the disguised wp-smart-thumbnails plugin) and the mu-plugin backdoor set (class-wp-token-validate.php, class-wp-query-*.php, wp-cache-optimizer.php) by filename or MD5.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1136, T1078, T1505.003, T1027, T1564
- **Data sources:** wordpress_rest_api_audit_log, web_access_logs, file_integrity_monitoring, edr_file_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=web sourcetype=access_combined uri_path="/wp-json/wp/v2/users" method=POST status=201)
OR (index=wordpress_audit sourcetype=wp_user_created (new_user_login="bd_*" OR new_user_email="*@wordpress.org" OR new_user_email="*@developer.wordpress.org"))
OR ((index=fim OR index=edr) md5 IN ("1024732009983dd5e54b4cf5593f04d4","7719cd98a35ffad2771f26d1ceab7d27","9aadc3e5c5242b273bd17c5bdc358845","e450ae5bc4bfc0d960dded06a76bb8e9"))
OR ((index=fim OR index=edr) (file_name="emer-run.php" OR file_path="*/wp-content/plugins/wp-smart-thumbnails/*" OR file_path="*/wp-content/mu-plugins/class-wp-token-validate.php" OR file_path="*/wp-content/mu-plugins/class-wp-query-*.php" OR file_path="*/wp-content/mu-plugins/wp-cache-optimizer.php"))
| eval detection_reason=case(
    match(uri_path, "wp-json/wp/v2/users"), "rest_api_user_creation",
    isnotnull(new_user_login), "rogue_admin_username_bd_prefix_or_spoofed_email",
    isnotnull(md5), "known_ioc_file_hash_match",
    1=1, "known_backdoor_filename_or_path")
| table _time, host, src_ip, new_user_login, new_user_email, uri_path, file_name, file_path, md5, detection_reason
| sort - _time
```

### Microsoft KQL

```kql
let KnownHashes = dynamic(["1024732009983dd5e54b4cf5593f04d4","7719cd98a35ffad2771f26d1ceab7d27","9aadc3e5c5242b273bd17c5bdc358845","e450ae5bc4bfc0d960dded06a76bb8e9"]);
let KnownPaths = dynamic(["emer-run.php","wp-smart-thumbnails","class-wp-token-validate.php","class-wp-query-","wp-cache-optimizer.php"]);
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where MD5 in (KnownHashes) or FileName has_any (KnownPaths) or FolderPath has_any (KnownPaths)
| project TimeGenerated, DeviceName, FileName, FolderPath, MD5, InitiatingProcessAccountName
| union (
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where RequestURL has "/wp-json/wp/v2/users" and RequestMethod == "POST"
    | project TimeGenerated, DeviceName=DestinationHostName, FileName=strcat(""), FolderPath=RequestURL, MD5=strcat(""), InitiatingProcessAccountName=SourceUserName
)
| order by TimeGenerated desc
```

### Sigma

```yaml
title: BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop
id: 3c4d5e6f-7a8b-49c0-9d1e-2f3a4b5c6d7e
status: experimental
description: Detects creation of WordPress administrator accounts with the bd_ deterministic username pattern or @wordpress.org/@developer.wordpress.org spoofed email, and/or file drops matching the known emer-run.php webshell and mu-plugin backdoor set (class-wp-token-validate.php, class-wp-query-*.php, wp-cache-optimizer.php).
references:
    - https://wordfence.com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response
    - https://gbhackers.com/wordpress-supply-chain-attack-exploits-bdthemes-plugins/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-10
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1556
    - attack.privilege-escalation
    - attack.t1078
    - attack.defense-evasion
    - attack.t1027
    - attack.t1564
    - attack.tool.emer_run
logsource:
    category: file_event
    definition: Requires file integrity monitoring or EDR file-creation telemetry on the WordPress webroot, plus WordPress REST API / audit-log ingestion for user-creation events
detection:
    selection_hash:
        Hashes|contains:
            - '1024732009983dd5e54b4cf5593f04d4'
            - '7719cd98a35ffad2771f26d1ceab7d27'
            - '9aadc3e5c5242b273bd17c5bdc358845'
            - 'e450ae5bc4bfc0d960dded06a76bb8e9'
    selection_filename:
        TargetFilename|contains:
            - 'emer-run.php'
            - 'wp-smart-thumbnails'
            - 'class-wp-token-validate.php'
            - 'class-wp-query-'
            - 'wp-cache-optimizer.php'
    condition: selection_hash or selection_filename
falsepositives:
    - Legitimate plugin coincidentally named wp-smart-thumbnails or a coincidental mu-plugin filename collision (low probability given the exact MD5 match requirement)
    - Bulk user-import/migration tooling creating admin accounts via the REST API for legitimate onboarding
level: critical
```

**Known false positives:**

- A legitimate plugin coincidentally named wp-smart-thumbnails or a coincidental mu-plugin filename collision (low probability given the exact MD5 match requirement)
- Bulk user-import tools or migration scripts creating admin accounts via the REST API for legitimate onboarding

**Tuning notes:** Feed the four published MD5 hashes and the bd_<6-char base36> username regex into a scheduled hunt in addition to real-time alerting; extend the mu-plugins path list if BdThemes/Sigmative or Wordfence publish updated backdoor variants, and require the file-hash or filename match (not the REST API call alone) before treating the alert as critical to avoid flooding on legitimate admin onboarding.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BdThemes Biggopti Poisoned API / Malicious Payload Retrieval (locked: unlock with TL Creds)
- BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop (locked: unlock with TL Creds)
- BdThemes Magic-Login Backdoor Use and [indicator] C2 Beacon (locked: unlock with TL Creds)
- BdThemes Biggopti Poisoned API / Malicious Payload Retrieval (locked: unlock with TL Creds)
- BdThemes Rogue Administrator Creation and Webshell/mu-plugin Drop (locked: unlock with TL Creds)
- BdThemes Magic-Login Backdoor Use and [indicator] C2 Beacon (locked: unlock with TL Creds)
- BdThemes Biggopti Poisoned API / Malicious Payload Retrieval (locked: unlock with TL Creds)
- BdThemes Magic-Login Backdoor Use and [indicator] C2 Beacon (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- Domain: `ia-cdn[.]com`
- File hash: `1024732009983dd5e54b4cf5593f04d4`
- Domain: `api[.]sigmative[.]io`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BdThemes plugins supply-chain hack creates rogue WordPress admins](https://www.bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/)
- [PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response](https://wordfence.com/blog/2026/08/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response)
- [WordPress Supply Chain Attack Exploits BdThemes Plugins to Create Rogue Admin Accounts and Install Webshells](https://gbhackers.com/wordpress-supply-chain-attack-exploits-bdthemes-plugins/)
- [BDThemes WordPress Supply Chain Attack Creates Rogue Admins and Deploys Webshells](https://cyberpress.org/bdthemes-wordpress-supply-chain-attack/)
- [New WordPress Supply Chain Attack Compromises Themes via Poisoned API Response](https://cybersecuritynews.com/wordpress-supply-chain-attack/)
- [WordPress Plugins Compromised Without a Single File Change](https://www.infosecurity-magazine.com/news/bdthemes-wordpress-poisoned-api/)
- [PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response (repost)](https://malware.news/t/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response/124607)
- [Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick — CVE-2026-18072](https://github.com/advisories/GHSA-45wh-rxq4-jqc6)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1978