BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
- ID
- 12995
- Status
- summarized
- Published
- 11 Aug 2026, 1:48 PM
- Fetched
- 11 Aug 2026, 4:09 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 11 Aug 2026, 4:12 PM
- Tags
- Audience
- developerssaas_founders
What happened
A supply chain attack on WordPress plugin vendor BdThemes compromised at least seven Elementor add-on plugins, including Element Pack (100,000+ active installs), by poisoning a remote JSON data stream rather than modifying any source code in the WordPress.org repository. The XSS flaw in the 'Biggopti' promotional banner component, which fetches JSON from a DigitalOcean Spaces bucket via the Sigmative API, allowed attackers to inject scripts via the 'display_id' parameter and potentially create rogue admin accounts. WordPress.org disabled all affected plugins on August 7-8, 2026 pending full review.
Why it matters
If you run WordPress sites with any BdThemes Elementor add-ons (especially Element Pack, Live Copy Paste, or Ultimate Store Kit), check immediately whether these plugins are installed and assume admin-level compromise is possible even though no plugin files were altered. For builders shipping plugins or SaaS that fetch remote JSON for dashboards or banners, this is a concrete lesson: client-side escaping of remotely fetched JSON fields like 'display_id' is mandatory, and a compromised CDN or API endpoint can escalate to full admin takeover without touching your codebase.
Discussion angle
The novel attack vector here—poisoning a remote JSON promotional-banner feed instead of modifying repository code—means traditional checksum or repo-integrity monitoring would miss this entirely. Discuss what monitoring or architectural changes would catch a compromised third-party API response before it executes in your admin panel.