Do Son 
At a Glance
| Malware family | API-driven XSS supply chain implant (Biggopti banner abuse) |
| Threat actor | Suspected; linked to the ARVE and OptinMonster campaigns |
| Targets | WordPress sites running seven BdThemes plugins |
| Delivery vector | Poisoned remote JSON feed from the vendor’s storage bucket |
| Key capabilities | Rogue admin creation, webshell upload, stealth persistence |
| Source | Wordfence Threat Intelligence Team |
TL;DR
Wordfence disclosed a BdThemes supply chain attack on August 7th, 2026. Attackers poisoned a promotional banner feed, not the plugin code, to fire XSS inside admin browsers. The script then builds rogue admins, plants a webshell, and installs backdoors.
Why This Supply Chain Attack Matters
This BdThemes supply chain attack breaks the usual detection model. According to Wordfence, “zero source code files were modified within the official WordPress.org repository.” No plugin update is needed to become a victim.
Because nothing changes on disk, file scanners and firewalls miss it. Wordfence calls the campaign “entirely API-driven, invisible to file-based integrity scanners and barely visible to Web Application Firewalls.”
How the Attack Works
Delivery
BdThemes plugins ship a component called Biggopti. It pulls banner data from a vendor API backed by a static storage bucket. Attackers gained write access to that bucket and swapped clean JSON for a crafted payload.
Infection Chain
An unescaped display_id field lets the payload break out of an HTML attribute. As a result, a hidden event handler fires within milliseconds on every dashboard page load. The script runs in the logged-in admin’s session.
From there, it creates a rogue administrator through the REST API. Next, it uploads a fake plugin containing a webshell. Finally, it installs must-use plugin backdoors, including a magic-login bypass and a module that hides the rogue accounts.
C2 and Exfiltration
The implant contacts a command-and-control server for targeting instructions before acting. It reports each step back using browser beacon requests. One payload variant even derives predictable admin usernames and passwords from the site’s hostname.
Defense and Detection
All affected plugins are temporarily closed on the WordPress directory pending review. Wordfence urges owners to audit database user lists, plugin directories, and the options table for indicators of compromise. You can read the full Wordfence advisory on the BdThemes compromise for the complete IoC list.
Watch for admin accounts using wordpress.org email domains and usernames starting with “bd_”. No confirmed victim count has been published yet.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
