Hackers hijacked BdThemes WordPress plugins to quietly create secret admin accounts

Key points

• Attackers broke into BdThemes' servers and used them to push malicious code to customer WordPress sites.
• Security firm Defiant, which runs the Wordfence firewall, began seeing attacks on August 7; the campaign may have started as early as June 23.
• The malicious code silently created hidden administrator accounts and installed a backdoor on affected sites.
• WordPress.org removed all BdThemes plugins on August 8; Element Pack alone has over 100,000 active installs, with the vendor's total portfolio topping 350,000.
• The command-and-control servers match those used in attacks on the Advanced Responsive Video Embedder and OptinMonster plugins, according to Wordfence.

Hackers broke into the servers that BdThemes, a Bangladesh-based maker of paid WordPress plugins, uses to deliver promotional banners to customers. They replaced the banner content with malicious code. Every time a site owner opened their WordPress admin page, that code ran silently and created a new, hidden administrator account for the attackers.

Defiant, the company behind the Wordfence firewall, spotted the attack on August 7. BleepingComputer first reported it publicly.

WordPress.org pulled every BdThemes plugin from its directory on August 8 while it investigates. That includes Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. Element Pack alone runs on more than 100,000 sites. This is the same supply-chain playbook we reported in June, when attackers compromised ShapedPlugin's own build pipeline to push backdoored releases to paying customers.

How did the attackers get in?

They gained write access to the vendor's cloud storage bucket and modified a file that WordPress admin dashboards fetch on every page load. That file normally delivers a small promotional banner. Instead, it delivered attack code.

A coding flaw introduced in March 2026 made this possible. A component called the Biggop Library, included in BdThemes' plugins, failed to properly sanitise data fetched from the vendor's own server before rendering it. That gap is a cross-site scripting flaw, meaning attacker-controlled text executes as code inside the victim's browser. Wordfence rated it medium severity, and it remains unpatched. Because the poisoned file came from a server the plugins already trusted, the whole thing required no fake updates, no dodgy downloads, nothing the admin would notice.

What did the malicious code actually do?

Two things. First, it used the logged-in admin's own session to create administrator accounts under the attackers' control. Second, it installed a fake plugin containing a webshell, a small file called emer-run.php that lets an outsider run commands on the server, so attackers could return even if those accounts were later deleted.

The code also tampered with WordPress database queries so the rogue accounts wouldn't appear in the user list, making the compromise harder to spot.

Who is behind this?

Defiant's researchers say the command-and-control infrastructure matches what they saw in earlier supply-chain hits on the Advanced Responsive Video Embedder and OptinMonster. The same pattern, fingerprinting logged-in admins before provisioning rogue accounts, appeared in the OptinMonster incident we covered on 15 June. Someone is working through the WordPress plugin ecosystem methodically.

What should site owners do now?

If you run a BdThemes plugin, treat the site as potentially compromised. Deactivate the plugins. Review every administrator account and remove any you didn't create. Check the plugins folder for unfamiliar files, particularly emer-run.php or w2.js. Rotate passwords for all admin users.

The two poisoned server endpoints now return clean data again, but that stops only fresh infections. It doesn't remove backdoors already on your site.

BdThemes has not published a public statement about the incident.