Loading story…
A supply-chain attack hit multiple BdThemes WordPress plugins after attackers poisoned JSON returned by the Biggopti promotional banner component, causing malicious JavaScript to execute in authenticated wp-admin sessions. The issue stemmed from unsafe handling of the display_id field, creating an admin-side cross-site scripting condition without any need to modify plugin files in the WordPress.org repository. Reported affected plugins included Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste for Elementor, and Smart Admin Assistant.
The malicious feed was reportedly served from a DigitalOcean Spaces bucket behind Cloudflare and was used to create rogue administrator accounts, install a fake plugin containing a webshell, deploy must-use plugin backdoors for persistence and stealth, and exfiltrate results to a command-and-control server. Researchers said the campaign may have started as early as June 23, 2026, was observed in the wild on August 7, and the poisoned endpoints were cleaned on August 8, but the vulnerability remained unpatched at the time of reporting and site owners were urged to check for lingering compromise artifacts.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
By 2026-08-08, the compromised promotional API endpoints were returning clean JSON again, ending active delivery of the malicious payloads through the vendor feed.
On August 8, 2026, the affected BdThemes plugins were removed from the WordPress.org directory pending investigation into the supply-chain compromise. The action affected plugins including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.
The attack was observed in the wild on 2026-08-07, and the affected BdThemes plugins were closed in the WordPress plugin directory while the incident was investigated.
Wordfence Threat Intelligence was notified of the incident on August 7, 2026. The campaign involved poisoned JSON responses consumed by the Biggopti component in multiple BdThemes WordPress plugins.
Wordfence said the BdThemes supply-chain campaign may have started as early as June 23, 2026, based on timestamps in poisoned promotional API records.
The report states the vulnerable unescaped handling of the remote `display_id` value was introduced on 2026-03-01 in Prime Slider version 4.1.9, later propagating to other BdThemes plugins.
Researchers said the command-and-control infrastructure used in the BdThemes supply-chain compromise overlapped with the same attacker behind recent supply-chain compromises affecting Advanced Responsive Video Embedder and OptinMonster. This added an attribution link between the BdThemes incident and earlier campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceinfosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcewordfence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers tampered with JavaScript served from **Awesome Motive** infrastructure for the widely used WordPress plugins **OptinMonster**, **TrustPulse**, and **PushEngage**, triggering a supply-chain compromise that Sansec said exposed more than **1.2 million sites**. The malicious code activated only when a logged-in WordPress administrator visited an affected site, then stole authentication data, exfiltrated site details to the typosquatted domain `tidio.cc`, created rogue administrator accounts, and deployed a stealth plugin designed to hide from normal WordPress administrative views. Researchers said the hidden plugin provided **unauthenticated remote code execution** through a web shell and an `eval`-style endpoint, effectively giving attackers arbitrary PHP execution on compromised servers. Sansec verified malicious code in OptinMonster and TrustPulse CDN files beginning June 12 and said those paths were later cleaned, while some PushEngage CDN edges continued serving infected code until June 14; the exact initial compromise point remains unknown, but the distribution path ran through Awesome Motive-operated domains via BunnyNet CDN. Defenders were urged to treat any affected site with an administrator logged in during the exposure window as fully compromised, remove rogue users, search for hidden plugin directories, and rotate all administrator credentials and secrets.
Aug 11, 2026
A supply-chain attack hit the **Essential Plugin** WordPress portfolio after the plugin business was reportedly acquired by a new owner who inserted a hidden backdoor into trusted add-ons used by thousands of websites. Researchers said the malicious code was added to `Countdown Timer Ultimate` version `2.6.7` in August 2025 as a PHP deserialization backdoor, then left dormant for about eight months before activating in early April 2026. Once triggered, affected sites contacted `analytics.essentialplugin.com`, received additional payloads, and had malicious code written into `wp-config.php`. The compromise allowed attackers to serve hidden spam links, fake pages, and redirects to Googlebot while remaining largely invisible to site owners. WordPress.org subsequently closed all **31** Essential Plugin entries in the plugin directory and pushed version `2.6.9.1` to remove the phone-home behavior, but reports warned that the update did **not** clean already-compromised `wp-config.php` files. Hosting providers and researchers urged administrators to manually inspect and remove any still-installed malicious plugins and persistence left on their servers, underscoring the risk that plugin ownership changes can turn established WordPress software into a malware distribution channel.
Jun 29, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026