Wordfence reports BdThemes supply-chain compromise through WordPress admin feed

Why it matters

Plugin developers that fetch vendor-controlled promotional content inside `wp-admin` add that upstream system to the security boundary protecting logged-in administrators.

Selim Rana's BdThemes built its WordPress business by giving site owners a large catalog of design tools. A reported compromise of the infrastructure behind those products exposed the risk embedded in one shared feature: a promotional feed that ran inside customers' authenticated admin dashboards.

BleepingComputer, citing Wordfence researchers, reported Monday that an attacker obtained write access to a vendor-controlled storage bucket and replaced legitimate JSON records with malicious content. According to that report, BdThemes plugins fetched the poisoned feed and rendered it through vulnerable browser code, allowing JavaScript to create administrator accounts and install a webshell.

Rana founded BdThemes in 2012 in Bogura, Bangladesh. Sigmative's public materials say BdThemes moved under the Sigmative name in January 2025, expanding beyond its original collection of WordPress and Elementor products. That distribution gave Rana a sizable footprint: BdThemes says its products run across more than 350,000 active sites, while its flagship free plugin has more than 100,000 active installations verified by WordPress.org.

The same shared plumbing that helped BdThemes promote products across that footprint gave the attacker a centralized delivery channel, according to BleepingComputer's account of the Wordfence findings.

A promotional banner became privileged code

Wordfence researchers disclosed the compromise on August 8, one day after detecting attacks through Wordfence's web application firewall. BleepingComputer reported that the Biggop Library powered a BdThemes component that retrieved promotional banners from the vendor's API and displayed them in WordPress admin dashboards.

BleepingComputer, citing the researchers, reported that the attacker had obtained write access to a vendor-controlled storage bucket. No malicious plugin package needed to pass through the WordPress.org repository. No update needed to reach a customer. The vulnerable plugins loaded the remote feed when a logged-in administrator visited a wp-admin page, placing the malicious script inside an authenticated browser session.

According to BleepingComputer's account of the Wordfence findings, the injected JavaScript created unauthorized administrator accounts. A payload called w2.js installed a fake plugin containing the emer-run.php webshell, while injected code manipulated database queries to conceal rogue accounts from the normal user list.

Wordfence rated the underlying cross-site scripting vulnerability medium severity because exploiting it first required compromise of BdThemes' upstream infrastructure. Once that condition was met, the observed payload delivered administrative access and remote code execution, according to the researchers.

One shared component expanded the blast radius

Wordfence identified several affected plugins, including Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit and Ultimate Store Kit. BdThemes used the same Biggop Library and remote promotional system across those products.

The Element Pack directory listing shows more than 100,000 active installations. Wordfence's vulnerability records put Ultimate Post Kit at roughly 30,000 active installations. BdThemes' broader claim of more than 350,000 active installations covers its portfolio and should be read as a measure of potential reach, rather than a count of infected sites.

Wordfence placed the campaign's earliest possible start on June 23rd, based on a date in the poisoned promotional record. Researchers observed attacks in the wild on August 7th.

The attack also bypassed a basic assumption behind software integrity checks. The packages installed from WordPress.org could remain unchanged while code fetched later from BdThemes infrastructure compromised the site. File-comparison tools would see legitimate plugin files even as an administrator's browser executed the attacker's JavaScript.

That design choice carries particular weight for a plugin vendor. Promotional banners are a growth channel, letting BdThemes advertise upgrades and other products inside the most valuable screen it controls. Loading those banners remotely also made a marketing system part of the security boundary for every administrator using the component.

Wordfence listed the Biggop Library flaw as unpatched when it published its August 8th analysis. Customers still need version-level information that distinguishes vulnerable releases from remediated ones and explains how to identify affected installations.

BdThemes faces a trust repair job

Rana spent more than a decade turning BdThemes into a recognizable supplier in the crowded market for WordPress and Elementor add-ons. The compromise puts that distribution advantage under strain because customers must evaluate security across a product family that shared the same administrative component.

The immediate engineering work extends beyond blocking malicious content from the remote feed. BdThemes needs to remove or correctly escape attacker-controlled values, rotate credentials that could have granted access to upstream infrastructure, review every product containing the shared library and reduce the authority of content fetched from outside an installed plugin. Administrators also need version-level guidance that distinguishes vulnerable releases from remediated ones.

The number of sites that executed the payload remains the central measure of impact. Active-install totals describe the reachable population, while successful infections require a logged-in administrator to have opened a dashboard while the poisoned response was available. Sites that executed it may retain malicious accounts or webshells after the upstream content changes.

For Rana, the recovery depends on making that distinction visible and verifiable. BdThemes grew by centralizing product promotion across a broad plugin catalog. Restoring confidence requires BdThemes to show that the shared channel has been redesigned, that affected installations can be identified and that compromised customers have a concrete remediation path.