Wordfence has warned about a supply chain compromise affecting several BdThemes WordPress plugins. This is not the usual story where a plugin file in the WordPress.org repository gets changed and everyone waits for a cleanup release. According to Wordfence, attackers poisoned a remote JSON data stream used by a BdThemes admin banner component, so malicious code could run inside wp-admin when an administrator loaded dashboard pages.
Key Takeaways
- Wordfence reported a BdThemes supply chain compromise on August 7, 2026.
- The attack used poisoned remote JSON, not modified plugin files in the WordPress.org repository.
- Logged-in wp-admin visits could trigger silent XSS execution.
- Affected sites may have rogue admin accounts, fake plugins, webshells, or MU-plugin backdoors.
- Administrators should check affected plugins and follow the Wordfence source for updates.
Which BdThemes plugins are listed
Wordfence lists these affected plugins: Element Pack Addons for Elementor, Live Copy Paste for Elementor, Pixel Gallery Addons for Elementor, Prime Slider Addons for Elementor, Smart Admin Assistant, Ultimate Post Kit Addons for Elementor, and Ultimate Store Kit.
That last one matters for some WooCommerce and EDD sites too, not only typical Elementor brochure websites. If one of these plugins is installed, this deserves a same-day check, not a note for next month.
Why this attack is awkward to spot
The compromised path was the Biggopti component, which fetched promotional banner data from a remote API and rendered it in the WordPress admin area. Wordfence says no source code files were modified in the official WordPress.org repository. The malicious payload came through poisoned static JSON instead.
That makes the incident nastier than a simple bad plugin update. A file integrity scan may say the plugin files look fine, while the browser of a logged-in administrator still receives hostile data from outside the site.
What could happen on a WordPress site
Wordfence describes the issue as Cross-Site Scripting through the display_id parameter from the Sigmative API in the Biggopti Library. The vulnerability is listed with a CVSS score of 5.4 Medium and patch status shown as unpatched in the report.
Once triggered in wp-admin, the injected script could create rogue administrator accounts, upload a fake webshell plugin, install Must-Use plugin backdoors, and communicate with a command-and-control server. In practical terms: someone may have gained durable admin-level access without touching the normal plugin files.
What administrators should check now
Start with the boring but important list: check whether any listed BdThemes plugin is installed, active, or recently removed. Then review administrator accounts, especially unfamiliar users or users hidden from the normal list. Check installed plugins for neutral-looking unknown items, inspect the mu-plugins directory, and scan the site with malware tools that do more than compare files against the repository.
Server logs, WordPress user creation events, plugin upload activity, and unexpected files such as webshells are also worth checking. If you maintain client sites, this is one of those moments where a quick inventory beats optimistic waiting.
Status and source to follow
Wordfence says the affected plugins were temporarily closed pending full inspection and an ongoing investigation by the WordPress Plugins team. The report also links the command-and-control domain to threat actors behind recent Advanced Responsive Video Embedder and OptinMonster supply chain attacks.
Because this is an active security issue and details may change, site owners should read the original Wordfence advisory and follow updates from the plugin and WordPress.org teams: Wordfence Blog source.
Frequently Asked Questions
Which BdThemes plugins should WordPress admins check?
Wordfence lists Element Pack Addons for Elementor, Live Copy Paste for Elementor, Pixel Gallery Addons for Elementor, Prime Slider Addons for Elementor, Smart Admin Assistant, Ultimate Post Kit Addons for Elementor, and Ultimate Store Kit.
Did this compromise come from modified plugin files on WordPress.org?
According to Wordfence, no source code files were modified in the official WordPress.org repository. The malicious payload was delivered through poisoned static JSON from a remote API.
How could the attack run inside wp-admin?
Wordfence says the Biggopti component fetched promotional banner data from a remote API and rendered it in the WordPress admin area. The reported XSS could execute when a logged-in administrator loaded wp-admin pages.
What signs of compromise should administrators look for?
Administrators should check for unfamiliar administrator accounts, unknown plugins, fake webshell plugins, Must-Use plugin backdoors, unexpected files, and relevant user creation or plugin upload events in logs.
What is the current status of the affected plugins?
Wordfence says the affected plugins were temporarily closed pending full inspection and an ongoing investigation by the WordPress Plugins team. The report listed the vulnerability as unpatched.