Security Alert supply chain engagement campaign attacks WordPress through remote JSON and persistent XSS

Security researchers have detected a supply chain engagement campaign that took advantage of a promotional component of BdThemes, a WordPress supplement provider, to take control of sites without altering the plugin files hosted in the official repository. As a result, the WordPress plugin team temporarily disable the downloads of the affected extensions in the official directory on August 7 and 8, 2026, until a review was completed. The technique does not change disk code within the repository: it exploits remote JSON used to display administrative banners and runs persistent XSS in the administrator browser.

Confirmed facts: a technical report published by external researchers (Wordfence) describes that the vector is a bookstore included in several BdThemes plugins, called Biggopti, that downloads JSON data from a Digital Ocean Spaces bucket to render promotional banners on the wp-admin panel. These JSON contain a "display _ id" parameter that does not escape correctly in the client, allowing for the injection of scripts (XSS) when an attacker controls the JSON content. The operation activates a JavaScript file (e.g. "w2.js") that contacts a command and control server (C2), creates administrative accounts, uploads a ZIP that deploys a PHP web shell ("emer-run.php") and installs persistence in the Must-Use plugins (mu-plugins) folder, including a "magic login" backdoor and a module that hides malicious users. The failure received a CVSS score of 5.4 and the vulnerable change was first introduced on 1 March 2026 in at least one of the affected packages.

How it works technically: the Biggopti component acts as a client who requests remote JSON hosted by the developer (in DigitalOcean Spaces). If an offensive actor gets writing permits on that storage, you can replace JSON responses with payloads that include HTML / JS malicious in the vulnerable field. Each time an administrator accesses any wp-admin page, the browser interprets the banner and runs the script injected in the domain context - which provides management capabilities (through the REST API), plugin uploading and remote execution without changing the original plugin code on the server. This chain avoids most file integrity based verifications because it does not modify the files in the WordPress.org. repository.

Who is at risk and why it matters: any WordPress site with one of the affected extensions and with at least one user admit that you have login is potentially vulnerable. The list of plugins involved includes several popular packages (for example, "bdthemes-element-pack-lite" with 100,000 + active facilities), but there are also extensions with fewer facilities. The practical consequence is complete administrative usurpation of the site: creation of accounts, installation of web shells, persistence difficult to detect and exfiltration of information or pivot to other systems. In addition, the technique makes general detection more costly because it does not leave obvious changes in the plugin files distributed by WordPress.org.

Engagement indicators and detection actions: look for users with patterns mentioned by researchers (e.g. names that start with "bd _" followed by a hash) and check files and directories byemer-run.phpor suspicious entries in mu-plugins. Check HTTP logs for outgoing requests to C2-associated domains (for example, the campaign contacted a host identified as ia-cdn [.] com / fz / c in the report) and look for recent applications for "api-data-all-records" or "api-data-records" API endpoints. Also a sign of commitment is the emergence of ZIP or plugins recently uploaded by users who should not have installed them.

Concrete and immediate measures to be taken by managers (confirmed and practical): change all administrative and active 2FA credentials; check and remove unrecognized administrative accounts; review and, if necessary, restore from backup prior to 1 March 2026; investigate the presence of such files (emer-run.php, w2.js, x.js) and entries in mu-plugins; block at the firewall level and infrastructure the outgoing communications to the indicated C2; remove and regenerate keys / credentials from the storage provider (Digital Spaces) if their own site or parts. If you have no internal response capacity, contact a forensic provider or the WordPress security team for assistance.

Recommendations for developers and plugin administrators: never trust remote JSON data without customer sanitation and escape; apply server-side sanitation and strict field validation that are injected into HTML; consider signing or serving remote assets from stored and controlled origins with integrity mechanisms (SRI / headers) and limit access permits in object buckets. Implement Restrictive Content Security Policy (CSP) in the admin area to mitigate remote scripts.

Distinction between confirmed facts, estimates and uncertainties: it is confirmed that Wordfence documented the exploitation of remote JSON and that WordPress deactivated the plugin downloads while being investigated. It is a reasonable estimate - based on technical indicators of the report - that the actor pursues administrative persistence to pivote or execute malicious mass code (spam, crypto, botnets), because the chain of actions facilitates it. What remains uncertain and unpublicly confirmed is the identity of the C2 operator, the total number of sites involved in nature and whether the BdThemes account was directly compromised or whether there was an intermediate failure in the deployment chain of its storage. It is also a technical correlation (not a definitive attribution test) that the same C2 servers are related to previous campaigns against other plugins.

For additional technical information and context on XSS and CVE management, see public resources such as Digital Ocean Spaces documentation and vulnerability registration: https: / / www.digitalocean.com / docs / spaces / and the vulnerability database (NVD) for the recent WordPress-corrected CVE: https: / / nvd.nist.gov /. Also follow the threat analysis blog of independent suppliers such as Wordfence for verified indicators and technical updates: https: / / www.wordfence.com / blog /.

Conclusion: This campaign highlights an increasing risk in software supply chains: not only the modification of distributed packages, but the manipulation of remote resources that are consumed in running time. Managers should prioritize proactive detection (user and device review), containment (C2 block, key rotation) and recovery from clean copies; developers, on the other hand, should eliminate any dependence that assumes blind confidence in remote content without validation. Complete review and coordination with the WordPress security team are essential steps before reenabling downloads or reinstalling compromised components.