BdThemes plugins targeted in supply chain attack via poisoned JSON data

Cybersecurity researchers have identified a critical supply chain attack targeting the WordPress plugin vendor BdThemes. Unlike traditional attacks that modify source code in the official WordPress repository, this compromise involves the poisoning of a static remote JSON data stream used by an internal component called Biggopti.

Attackers gained write access to the vendor’s object storage, such as DigitalOcean Spaces, to inject malicious JSON into a promotional banner component. When a logged-in administrator accesses the WordPress dashboard, a DOM-based cross-site scripting (XSS) vulnerability in the JSON response parsing code is triggered. This allows the execution of arbitrary web scripts in the administrator's browser.

Wordfence reported that the attack can lead to full site compromise. Once the script executes, it can use the administrator's session privileges to create unauthorized administrator accounts, drop web shells, establish persistence via MU-plugins, and hide the unauthorized accounts from view. Affected plugins include Element Pack Addons for Elementor, Live Copy Paste for Elementor, Pixel Gallery Addons for Elementor, Prime Slider Addons for Elementor, Smart Admin Assistant, Ultimate Post Kit Addons for Elementor, and Ultimate Store Kit. As a result of the discovery, the plugins have been temporarily disabled for download on the WordPress directory pending a full review.