BdThemes, a popular WordPress plugin provider, has fallen victim to a supply chain compromise that allows attackers to create rogue administrator accounts and deploy webshells without altering any code This article explores bdthemes popular wordpress. . Unlike other plugin breaches, the threat actors exploited a poisoning attack through a static JSON data stream fetched by "Biggopti," an internal promotional banner system used across BdThemes plugins including Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant.
A cross-site scripting flaw in how the script handled the display_id field, introduced in Prime Slider on March 1, 2026, left an HTML id attribute unescaped while properly sanitizing neighboring fields.
Attackers who gained write access exploited this vulnerability by injecting a malicious payload triggered through an onanimationstart event handler, which runs within 10 milliseconds of page load. That webshell installs two Must-Use plugins backdated to September 2025 for persistence: a magic-login backdoor that grants unauthenticated administrative entry via a ?_wplogin= URL token, and a stealth module that hides the rogue accounts from the admin user list. Free users will receive these updates after a standard 30-day delay.
Site owners should immediately review user lists for @wordpress.org emails or bd_-prefixed usernames in mu-plugins directories, inspect unfamiliar files in the database, and check for options tied to this campaign: fz_emer_login_tokens and fz_emer_done_v1.
