Hackers hijacked BdThemes WordPress plugins to quietly create secret admin accounts

Key points

• Attackers broke into the servers of BdThemes, a maker of paid WordPress design tools, and used them to push malicious code to customer sites.
• Security firm Defiant, which runs the Wordfence firewall, began seeing attacks on August 7, though the campaign may have started as early as June 23.
• The malicious code silently created hidden administrator accounts on affected WordPress sites and installed a hidden backdoor.
• WordPress.org removed all BdThemes plugins from its directory on August 8; the flagship Element Pack alone has over 100,000 active installs, with the vendor's total portfolio topping 350,000.
• The command-and-control servers match those used in recent attacks on the Advanced Responsive Video Embedder and OptinMonster plugins, according to Wordfence.

Hackers broke into the servers that BdThemes, a Bangladesh-based maker of paid WordPress plugins, uses to send promotional banners to its customers. They swapped the normal banner content for malicious code. Every time a site owner opened their WordPress admin page, that code ran in the background and created a new, hidden administrator account for the attackers.

First reported by BleepingComputer, the attack was spotted on August 7 by researchers at Defiant, the company behind the Wordfence firewall that protects WordPress sites.

WordPress.org pulled every BdThemes plugin from its download directory on August 8 while it investigates. That includes Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery and Ultimate Store Kit. Element Pack alone runs on more than 100,000 sites.

How did the attackers get in?

They found their way into the vendor's cloud storage and altered a file that WordPress admin dashboards fetch on every page load. That file is meant to deliver a small promotional banner. Instead, it delivered attack code.

A coding mistake in a component called the Biggop Library, part of BdThemes' plugins, made this possible. The library did not properly clean the data it received from the vendor's own server before displaying it. That gap is known as a cross-site scripting flaw, meaning attacker-controlled text gets executed as code inside the victim's browser. Wordfence rated it medium severity, and at the time of writing it remains unpatched.

Because the poisoned file was served from a source the plugins trusted, no fake updates or dodgy downloads were needed. The attack ran quietly in the background of the real administrator's browser session.

What did the malicious code actually do?

Two things. First, it used the logged-in admin's own session to create fresh administrator accounts under the attackers' control. Second, it installed a fake plugin containing a webshell (a small file called emer-run.php that lets an outsider run commands on the server) so the attackers could get back in even if the accounts were deleted.

The code also tampered with the WordPress user list so the rogue accounts would not appear on screen, making the break-in harder to notice.

Who is behind this?

Defiant's researchers say the servers used to control the attack match those seen in recent supply-chain break-ins involving the Advanced Responsive Video Embedder and OptinMonster plugins. That points to the same crew hitting the WordPress plugin ecosystem repeatedly.

What should site owners do now?

If you run a BdThemes plugin, treat the site as potentially broken into. Deactivate the plugins. Review every administrator account and remove any you did not create. Check the plugins folder for files you do not recognise, particularly anything named emer-run.php or w2.js. Rotate passwords for all admin users.

The two poisoned server endpoints have now been cleaned and return safe data again, but that only stops fresh infections. It does not remove backdoors already planted on your site.

BdThemes has not published a public statement about the incident.