# BdThemes Supply Chain Breach Exploits JSON Feeds in WordPress Plugins

*Published August 12, 2026*
*Source: [https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html](https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html)*

## Executive Summary

A supply chain attack on BdThemes has compromised WordPress plugins by manipulating JSON feeds to create unauthorized admin accounts without modifying plugin files. This breach highlights severe vulnerabilities in BdThemes' infrastructure and poses an ongoing threat to WordPress environments.

## Article

A recent supply chain attack targeting BdThemes, a WordPress plugin vendor, has raised alarms across the cybersecurity community. This breach leveraged a novel approach by manipulating a static remote JSON data stream accessed by an administrative promotional banner component, rather than altering source code files within the WordPress.org repository. The attack prompted WordPress to temporarily disable downloads of the affected plugins pending a thorough review.

The vulnerability was traced to an internal component called Biggopti, which fetches promotional banners from an API server and displays them in the WordPress admin dashboard. The flaw lies in the JSON response parsing code of this system, specifically via the 'display_id' parameter from the Sigmative API, due to insufficient client-side escaping. This flaw allows attackers to inject arbitrary scripts, which execute every time a user accesses the page, affecting any logged-in administrator silently.

The attack was first identified in the 'bdthemes-prime-slider-lite' plugin on March 1, 2026, and subsequently spread to others. By obtaining write access to the DigitalOcean Spaces bucket, attackers replaced legitimate JSON responses with crafted ones, exploiting the cross-site scripting (XSS) vulnerability. The compromised script then created rogue administrator accounts, uploaded a web shell plugin, and communicated with a command-and-control server.

The primary payload uses the 'api-data-all-records' API endpoint, with a JavaScript file named 'w2.js' performing malicious actions. An alternate payload, 'x.js', serves to generate administrative credentials derived from the website's hostname. These credentials are predictable, allowing threat actors to access compromised sites without central storage. This breach is linked to previous supply chain attacks, indicating an ongoing effort to establish covert administrative persistence and remote code execution across WordPress environments.

The attack underscores a severe upstream compromise of BdThemes' cloud storage credentials or internal infrastructure, marking a significant security breach. This incident coincides with WordPress addressing another XSS vulnerability (CVE-2026-64638), further highlighting the persistent threat landscape for WordPress users.