Supply chain compromise uses poisoned API, no files changed

Seven WordPress plugins were used to plant rogue administrator accounts and webshells on live websites without a single plugin file being modified. Instead, attackers poisoned a promotional data feed that the plugins load into the admin dashboard, according to a new analysis from Wordfence.

Attack Details Emerge

Wordfence was notified of the compromise on August 7 and published its analysis the following day. The attack affects BdThemes, an Elementor add-on vendor whose plugins are distributed through the official WordPress.org directory. All seven plugins have been temporarily closed pending review.

Nothing changed in the repository. The plugins ship a component called Biggopti that pulls promotional banners from the vendor's API. Attackers obtained write access to the object storage bucket behind it, swapping legitimate responses for crafted payloads.

Vulnerability Root Cause

The vulnerability was introduced by BdThemes itself. Wordfence traced it through SVN history to March 1, when a script added to Prime Slider began concatenating a field from the remote JSON response directly into an HTML attribute without escaping it. A neighboring attribute in the same code is escaped correctly, which Wordfence reads as an oversight rather than intent. A sanitizer added in May left the flawed attribute untouched.

Because the script runs on every wp-admin page load, the injected code fires silently in the browser of any logged-in administrator. The vulnerability record rates it 5.4, medium severity, and lists it as unpatched.

Webshell and Persistence

The payload used the administrator's own session token to create a new administrator through the WordPress REST API, then installed a fake plugin carrying a webshell. That webshell deployed two persistence modules. One grants unauthenticated administrative access through a URL parameter. The other hooks database queries to hide the rogue accounts from the user list and adjust user counts to match.

A second payload, hosted on BdThemes' own infrastructure, derived administrator credentials from the victim's hostname, meaning responders can compute exactly what to hunt for.

Attribution and Response

Wordfence linked the C2 domain to the actors behind the Advanced Responsive Video Embedder and OptinMonster compromises of the past two months, and said a payload sitting in the vendor's own bucket points to a serious upstream compromise. Both endpoints were clean by August 8. Because plugin files were never modified, Wordfence urged site owners to audit database user lists, plugin directories and the options table for indicators of compromise.

Why It Matters

This incident underscores a critical reality: malware can lurk in places you might not think to check. Traditional file integrity monitoring would not catch this attack, since the malicious code was never written to disk. This could mean that supply chain attacks are evolving beyond modifying files on disk. As vendors increasingly rely on remote data feeds for features like promotional banners, attackers are finding new ways to inject malicious content without leaving a trace in the codebase. For site owners, the key takeaway is to verify not just code integrity but also the behavior of any remote data sources your plugins depend on.