BdThemes Supply-Chain Attack Compromises 350,000+ WordPress Sites A threat actor breached the upstream infrastructure of BdThemes, a developer of premium WordPress plugins, and injected malicious code into a remote JSON feed used by administrative dashboards. The attack, first detected by Wordfence on August 7, exploited a cross-site scripting (XSS) vulnerability in the Biggop Library, a component used to fetch promotional banners from BdThemes’ API. The flaw, introduced in March 2026, allowed attackers to replace legitimate JSON responses with malicious JavaScript. When executed in an administrator’s browser, the code created rogue admin accounts and installed a webshell (emer-run.php) disguised as a fake plugin for persistence. The attack was stealthy, requiring no user interaction or file modifications, and manipulated database queries to hide the rogue accounts from the WordPress user list. Wordfence linked the campaign to the same threat actor behind recent supply-chain compromises of Advanced Responsive Video Embedder and OptinMonster, with the earliest signs of activity dating back to June 23. The affected plugins including Element Pack (100,000+ active installs), Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit were pulled from WordPress.org on August 8 pending a full review. While two poisoned API endpoints now return clean data, the vulnerability remains unpatched as of the report’s publication. BdThemes has not issued an official statement, and the total number of compromised sites remains unclear. The developer’s portfolio claims over 350,000 active installations.