Wordfence reports BdThemes supply-chain compromise through WordPress admin feed
Wordfence reported malicious code delivered through a BdThemes promotional system inside WordPress dashboards after an attacker poisoned a vendor-controlled JSON feed.
By Ryan Merket · Published
Primary source: BleepingComputer
Why it matters
Plugin developers that fetch vendor-controlled promotional content inside wp-admin add that upstream system to the security boundary protecting logged-in administrators.
Selim Rana's BdThemes built its WordPress business by giving site owners a large catalog of design tools. A reported compromise of the infrastructure behind those products exposed the risk embedded in one shared feature: a promotional feed that ran inside customers' authenticated admin dashboards.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.