AI Weekly Malaysia

A supply chain attack on WordPress plugin vendor BdThemes compromised at least seven Elementor add-on plugins, including Element Pack (100,000+ active installs), by poisoning a remote JSON data stream rather than modifying any source code in the WordPress.org repository. The XSS flaw in the 'Biggopti' promotional banner component, which fetches JSON from a DigitalOcean Spaces bucket via the Sigmative API, allowed attackers to inject scripts via the 'display_id' parameter and potentially create rogue admin accounts. WordPress.org disabled all affected plugins on August 7-8, 2026 pending full review.

Why: If you run WordPress sites with any BdThemes Elementor add-ons (especially Element Pack, Live Copy Paste, or Ultimate Store Kit), check immediately whether these plugins are installed and assume admin-level compromise is possible even though no plugin files were altered. For builders shipping plugins or SaaS that fetch remote JSON for dashboards or banners, this is a concrete lesson: client-side escaping of remotely fetched JSON fields like 'display_id' is mandatory, and a compromised CDN or API endpoint can escalate to full admin takeover without touching your codebase.

Researchers Alejandro Hernando and Borja Martinez demonstrated at DEF CON 34 that Windows 11's Plug and Play auto-install can be chained into full SYSTEM execution on a fully updated machine. The physical path emulates a Sierra Wireless device to install SwiService.exe, abuses its SetDNS primitive, then emulates a Sony FeliCa reader whose co-installer fetches config over plaintext HTTP with a path-traversal flaw to plant a DLL in System32. A remote variant forges synthetic USB traffic over RDP using a phantom Intel RealSense device and a CRYPTBASE.dll search-order hijack, though Microsoft notes RDP USB redirection is not enabled by default.

Why: If your team runs Windows 11 endpoints with RDP USB redirection enabled or allows untrusted USB devices on managed machines, this chain gives an unprivileged user or authenticated RDP user a path to SYSTEM. The practical action is to verify that low-level USB redirection over RDP is disabled (Microsoft says it is off by default) and restrict physical USB device installation on shared or kiosk-style Windows machines.