Hackers Poison BdThemes API to Hijack WordPress Websites via Admin Sessions

A sophisticated cyber-attack recently compromised the upstream network servers belonging to popular software developer BdThemes. The company creates widely used web design tools, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.

Hackers breached the vendor’s central storage bucket to alter an internal JSON data stream, secretly generating unauthorized administrator accounts across thousands of websites.

The impact of the security issue stretches over an extensive virtual presence in the global internet ecosystem. The principal free product of the company, Element Pack, has well over one hundred thousand active installations on the official WordPress repository.

In addition, the developer has a wider software portfolio enabling more than three hundred and fifty thousand active websites worldwide. Security teams quickly isolated the infected components to prevent additional site takeovers across active client domains.

Poisoned API Feeds and Cross-Site Scripting Exploitation Mechanics

The Defiance team made the first observation of questionable exploitation actions through its Wordfence firewall network. The researcher notes that the attacker managed to gain unauthorized write access to the private storage bucket of the developer software.

Subsequently, the attacker managed to corrupt a static JSON data feed sent directly to the admin dashboard banners. This remote server manipulation allowed the attacker to inject malicious code into innocent websites seamlessly.

The software vendor unintentionally introduced a coding flaw into its JSON response parsing logic earlier in March this year. This programming error created a stored cross-site scripting vulnerability within the internal Biggop Library framework. 

The vulnerable Biggopti component retrieves promotional announcements from the API server of the vendor to show inside customer dashboards. Consequently, the lack of output escaping allowed malicious scripts to execute automatically whenever website owners logged into their admin panels.

Attacker Access to  Storage Bucket to Poisoned JSON Feed, to XSS in Admin Dashboard to  Rogue Admin Created.

Furthermore, the injected script relies entirely on an active authenticated browser session of the administrator to execute commands. As soon as a legitimate owner logs into their dashboard, the hidden JavaScript code immediately executes in the background without any warnings.

The script then creates a malicious administrator access account that gives the hijacker complete control over the compromised server. This stealthy approach does not require any actions, file downloads, or plugins from the website owners.

Also, the malware downloads another script that gives permanent access to the hijacked web servers. The secondary script installs a fake plugin that has a web shell inside it and keeps access to the compromised account permanently.

Moreover, the script alters database queries so that the intruder will not show up in the standard lists of users. This clever masking technique makes the unauthorized account almost invisible during routine administrative checks.

Historical Timeline, C2 Infrastructure Links, and Directory Closures

Security researchers traced the operational infrastructure used in this supply chain campaign back across several months. Historical data logs suggest that the threat actors began probing vendor systems as early as June 23.

Also, threat intelligence analysts have directly associated the command-and-control server addresses to earlier-known, high-profile attacks on software supply chain. The underlying server infrastructure matches the exact network setups used in recent breaches against Advanced Responsive Video Embedder and OptinMonster. Security experts believe a single organized threat group coordinates these continuous WordPress plugin exploits to compromise enterprise web hosts.

The security team at WordPress took immediate action on August 8 by closing all affected BdThemes plugins. Official administrators removed the download links from the plugin directory pending a comprehensive security evaluation. Meanwhile, technicians fixed two poisoned API endpoints, ensuring they now deliver clean JSON data back to connected websites.

The vulnerability carries a medium severity score because it relies on upstream API server access. However, the flaw remained officially unpatched across core plugin files at the time of initial discovery.

Defensive Remediation Steps and Essential WordPress Hardening

Website owners running affected web design tools must take urgent manual steps to clean their server environments. Site managers should inspect their database tables directly using phpMyAdmin or custom SQL queries to uncover hidden accounts. Looking at the raw database helps reveal hidden administrators that the malicious script hides from the visual dashboard list.

Moreover, site owners must delete suspicious plugin folders and remove unknown PHP files like the emer-run.php web shell immediately. Changing all database passwords and resetting authentication keys forces active hacker sessions to terminate across all connected devices. Installing robust web application firewalls helps block external calls to known malicious command-and-control domains.

The urgency of these actions is underscored by a separate dark web data dump that exposed admin credentials for thousands of WordPress sites, with nearly 19,000 records reportedly compromised, including email addresses and plaintext passwords that could be used to take over site backends.

Therefore, site managers have to check the current roles of the users, remove unused software add-ons, and ensure clean offsite storage. Automated security scanners ought to undertake thorough inspection of the content of files to identify unexpected changes in the main system directories. Proactive server surveillance guarantees that owners of the websites find secret backdoors before cybercriminals hit the websites with secondary attacks.

Finally, there is a need to manage risks from third-party software using continuous vigilance across modern web publishing environments. It means that programmers have to ensure proper filtering of data outputs and inputs in all remote API integration points. Hardening of software development processes secures millions of downstream business websites from nasty compromise in the supply chain.