Attackers did not modify a single line of plugin code. According to Wordfence, they poisoned the promotional banner feed that seven WordPress plugins from BdThemes load into the administrator dashboard, turning every visit to wp-admin into silent code execution for any logged-in administrator.
The plugins pull banner content as JSON from the vendor's own cloud storage bucket. A component inside them takes one field from that response and places it directly into an HTML attribute without escaping it, while escaping the neighbouring attribute correctly, which Wordfence reads as an oversight rather than a deliberate backdoor. Attackers who gained write access to the vendor's bucket replaced the legitimate JSON with a value that breaks out of that attribute and attaches an event handler fired by a fraction-of-a-second animation. Nothing changes on disk, so file integrity scanners see nothing to flag.
What's affected
Wordfence names seven plugins, all now closed on the WordPress.org directory: Element Pack Addons for Elementor, Prime Slider Addons, Pixel Gallery Addons, Ultimate Post Kit Addons, Ultimate Store Kit, Live Copy Paste for Elementor and Smart Admin Assistant. The unescaped attribute was introduced on 1 March 2026 in Prime Slider 4.1.9 and copied to the others. Because the trigger arrives in a remote response rather than a plugin update, site owners did not have to install anything to be exposed.
How many sites were reached is not currently knowable. Wordfence publishes no victim count, and with all seven plugins closed the directory no longer reports install numbers. No CVE has been assigned, and the underlying flaw is rated CVSS 5.4, which scores the scripting issue rather than the outcome. The outcome is full site takeover, so treat the rating and the impact as two different things.
What the payload does
The main payload checks in with a command and control server, then takes the live session token from the administrator's browser to create a new administrator account through the WordPress REST API. It downloads an archive from that server and installs it through the ordinary plugin upload form under a neutral name, containing a web shell. Invoking the shell drops two must-use plugin modules whose timestamps are backdated to September 2025 so they blend in: one grants unauthenticated administrator access through a magic login parameter, the other hooks database queries to hide the rogue accounts from the user list and adjust the user counts.
A second variant is more useful to defenders than to the attackers. It derives its administrator credentials deterministically from the victim's own hostname, producing a username of bd_ followed by six characters, with a password built from the same value, paired with an address on a wordpress.org domain. Because the algorithm is fixed rather than random, a defender can compute the exact username and password that would exist on any given domain and hunt for it directly.
What you should do
Check for administrator accounts on wordpress.org or developer.wordpress.org email domains, and for usernames matching bd_ plus six alphanumeric characters, remembering that the stealth module is built to hide them from the user list. Inspect the must-use plugin directory, which ordinary plugin screens do not show. The indicators Wordfence published include the command and control host ia-cdn[.]com and the poisoned vendor endpoints at api[.]sigmative[.]io, both since cleaned, along with file hashes for the web shell and the persistence modules and the database options fz_emer_login_tokens and fz_emer_done_v1.
Wordfence attributes the campaign to the same actors behind two earlier plugin supply chain attacks, an assessment it does not show its working for, and says the ability to write files into the vendor's bucket points to a serious compromise of BdThemes' own infrastructure. BdThemes has not published a statement. Wordfence gave detection signatures to paying customers first, with free users receiving them after its usual 30 day delay.
The advisory, credited to Paolo Tresso, is on Wordfence's blog. It fits the shift we reported when Google's threat intelligence group found attackers poisoning open source packages rather than breaking into vendors directly, and follows a run of WordPress trouble including a bug that runs code on the server when an administrator clicks a link.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.