Seven WordPress plugins distributed through the official WordPress.org directory were compromised via poisoned JSON promotional feeds without any plugin file modifications, allowing attackers to create administrator accounts and deploy webshells on active sites, according to Wordfence analysis published August 8, 2026.
Wordfence received notification of the compromise on August 7 and traced the attack to BdThemes, an Elementor add-on vendor whose seven affected plugins have been temporarily closed pending review. The attack vector exploited a promotional banner system that pulls data from the vendor's API, with attackers gaining write access to the underlying object storage bucket and swapping legitimate responses for malicious payloads.
TL;DR: Attackers compromised seven WordPress.org plugins by poisoning a remote JSON feed used for admin dashboard promotional banners, deploying webshells and creating hidden administrator accounts without modifying any plugin files.
Attack Vector Bypassed Traditional File Integrity Checks
The compromise targeted a component called Biggopti that ships with all seven BdThemes plugins and loads promotional banner content from the vendor's API into the WordPress admin dashboard. Attackers obtained write access to the object storage bucket serving JSON responses, replacing legitimate promotional data with crafted exploit payloads that executed when administrators loaded any wp-admin page.
No files in the WordPress.org plugin repository were modified. Traditional security scanning focused on plugin file integrity would not detect the compromise. The malicious JSON responses injected code through an unescaped HTML attribute that concatenated remote data directly into banner markup without sanitization.
The vulnerability record rates the flaw at 5.4 medium severity and lists it as unpatched as of August 8. Wordfence traced the vulnerable code through SVN history to March 1, 2026, when a script added to the Prime Slider plugin began concatenating a field from the remote JSON response directly into an HTML attribute without escaping it, while a neighboring attribute in the same code block was correctly escaped.
Payload Created Hidden Administrator Accounts and Deployed Webshells
The injected code used the victim administrator's existing session token to create new administrator accounts through the WordPress REST API, then installed a fake plugin carrying a webshell. Because the exploit ran silently in the administrator's browser on every wp-admin page load, site owners received no notification of the account creation or plugin installation.
The webshell deployed two persistence modules. One grants unauthenticated administrative access through a specific URL parameter. The second hooks WordPress database queries to hide the rogue administrator accounts from the user list interface and adjust displayed user counts to match, preventing detection through standard admin panel reviews.
A second payload, hosted on BdThemes' own infrastructure, derived administrator credentials from the victim site's hostname, allowing responders to compute exactly which credentials to search for during incident response. Wordfence linked the command-and-control domain to actors behind the Advanced Responsive Video Embedder and OptinMonster compromises documented in June and July 2026.
The discovery of malicious payloads sitting in the vendor's own storage bucket indicates a serious upstream compromise beyond simple API credential theft. Both malicious endpoints returned clean responses by August 8, suggesting attackers removed evidence following Wordfence's disclosure.
Detection Requires Database and Filesystem Audits
Because no plugin files were modified during the attack, standard WordPress security tools that verify file integrity against repository checksums would not flag compromised installations. Site owners must audit database user tables for unexpected administrator accounts, scan the wp-content/plugins directory for unfamiliar plugin folders, and review the wp_options table for indicators of compromise.
The attack demonstrates a gap in WordPress ecosystem security monitoring, where third-party API dependencies introduce risk outside the plugin repository's code review process. Sites running any of the seven affected BdThemes plugins should assume compromise until manual audit confirms otherwise.
WordPress.org's plugin review team closed all seven BdThemes plugins pending security review. The closure prevents new installations but does not remove the plugins from sites already running them or trigger automatic updates to remove compromised components.
What Happens Next
Agencies managing white-label WordPress development should audit any client sites running BdThemes plugins for rogue administrator accounts and unexpected plugin installations. The attack vector—poisoned remote data feeds loaded into admin interfaces—applies beyond BdThemes to any plugin that pulls promotional content or feature flags from vendor-controlled APIs.
The incident reinforces the operational risk of plugin vulnerabilities that exploit without authentication. Standard security hardening that locks down file permissions and monitors repository integrity missed this attack entirely because the compromise occurred upstream of the files themselves. Agencies should document third-party API dependencies in their security assessment process and consider blocking promotional banner systems in client admin panels.
BdThemes has not issued a public statement on the compromise timeline or whether the upstream infrastructure breach extended beyond the promotional feed storage bucket. Until the vendor publishes a post-incident analysis, agencies cannot assess whether other BdThemes products or customer data were exposed in the same infrastructure compromise.