Ethical Hacking News
BdThemes Supply Chain Attack: A Web Security Threat That Exploits JSON Vulnerability
A recent web security threat has been identified in BdThemes' affected plugins, exploiting a vulnerability in the company's JSON data stream to create rogue administrators. This malicious activity highlights the importance of robust security measures and up-to-date plugin updates.
BdThemes, a WordPress plugin vendor, was hit with a supply chain compromise attack that exploits a vulnerability in their JSON data stream.The attack is caused by an internal component called Biggopti, which ships with affected plugins and has a cross-site scripting (XSS) flaw.The vulnerability allows attackers to inject arbitrary web scripts into pages, leading to silent activation of malicious code on every logged-in administrator's browser load.Rogue actors obtained write access to the vendor's bucket, replacing legitimate JSON responses with crafted payloads to exploit this vulnerability.The attack installs a PHP web shell, creates rogue administrators, and establishes covert administrative persistence across WordPress environments.
BdThemes, a WordPress plugin vendor, has recently found itself at the center of a significant web security threat. The attack, dubbed a supply chain compromise, exploits a vulnerability in the company's JSON data stream to create rogue administrators on affected plugins. This malicious activity is a prime example of how vulnerable software can be exploited by attackers, highlighting the importance of robust security measures and up-to-date plugin updates.
The source of this supply chain attack lies in an internal component called Biggopti, which ships along with the affected plugins. The system is designed to pull promotional banners from their API server and render them in the WordPress admin dashboard by fetching relevant JSON files from a DigitalOcean Spaces bucket. However, due to insufficient client-side escaping, a cross-site scripting (XSS) flaw was discovered in the JSON response parsing code via the "display_id" parameter from the Sigmative API.
This vulnerability allows an attacker who can compromise the API to inject arbitrary web scripts into pages that get executed every time a user accesses those pages. Since the script runs on every "wp-admin" page load, the injected code gets activated silently in the browser of any logged-in administrator. The attack, rated 5.4 on the CVSS scoring system, indicating medium severity.
The rogue actors obtained write access to the vendor's own bucket, replacing legitimate JSON responses with crafted payloads to exploit this vulnerability. They then delivered the main payload to the plugins using the "api-data-all-records" API endpoint, which is performed by a JavaScript file named "w2.js." The payload performs several actions, including:
1. Contacts the command and control (C2) server with the victim website's origin to fetch targeting instructions.
2. Creates a new rogue administrator via the WordPress REST API.
3. Downloads a fake plugin ZIP from the C2 server and installs it via the standard plugin upload form, resulting in the deployment of a PHP web shell.
4. Invokes the web shell to install two persistence modules into the Must-Use plugins directory: one is a "magic-login backdoor" that allows unauthenticated administrative entry via a URL parameter (?_wplogin=\[token\]), targeting the site's longest-registered administrator, and the other is an anti-analysis stealth module that hooks into WordPress database queries to conceal the presence of rogue user accounts from the administrative user list.
5. An alternate payload ("x.js") found hosted on the plugin developer's infrastructure is served to victims using the "api-data-records" API endpoint. This payload generates deterministic administrative credentials that are mathematically derived from the victim website's hostname.
The generated credentials are then leveraged to create a malicious administrator user, and the results of the attack are then exfiltrated back to the C2 server.
This supply chain attack is notable because it is entirely driven via the API and requires no plugin updates or files to be modified on disk. Moreover, the development comes days after WordPress addressed a pre-authentication reflected XSS flaw (CVE-2026-64638) that can be exploited to achieve PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.
The end goal of this campaign is to establish covert administrative persistence and remote code execution across WordPress environments. This attack serves as a stark reminder of the importance of monitoring software updates, implementing robust security measures, and staying vigilant against potential vulnerabilities in third-party plugins and software components.
Related Information:
https://www.ethicalhackingnews.com/articles/BdThemes-Supply-Chain-Attack-A-Web-Security-Threat-That-Exploits-JSON-Vulnerability-ehn.shtml
https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html
https://www.bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins/
Published: Tue Aug 11 02:19:15 2026 by llama3.2 3B Q4_K_M
