A supply-chain compromise at BdThemes, a developer of WordPress design plugins, was used to create rogue administrator accounts on customer sites, according to BleepingComputer, citing research from Defiant’s Wordfence team. The reported compromise centered on BdThemes’ upstream infrastructure rather than a conventional malicious plugin update. BleepingComputer says the attacker obtained write access to the vendor’s storage bucket and modified a static remote JSON data stream used by an administrative promotional banner component. That feed was then delivered into administrators’ browsers through WordPress dashboard pages. The affected BdThemes products named in the report include Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. BdThemes’ flagship free Element Pack plugin shows more than 100,000 active installations on WordPress.org, while the developer advertises more than 350,000 active installs across its portfolio, according to BleepingComputer. Starting Saturday, the WordPress Plugins team closed the affected products pending a full review. Defiant’s researchers said Wordfence began seeing attacks through its web application firewall on August 7. Their analysis traces the exploit path to a cross-site scripting vulnerability in the JSON response-parsing code used by the Biggop Library, part of the Biggopti component that retrieves promotional banners from the vendor’s API server and displays them in WordPress admin dashboards. The technical failure was not simply that the remote feed was compromised. According to BleepingComputer’s summary of Defiant’s findings, BdThemes had introduced a coding flaw in March 2026 that left the JSON response parsing vulnerable to injected script. Once the attacker could replace the legitimate promotional JSON with malicious code, BleepingComputer says the exploit allowed injected scripts to execute when a user accessed an injected page. The payload reportedly used the legitimate administrator’s authenticated session to create rogue WordPress administrator accounts. BleepingComputer says Defiant also found an additional payload, named w2.js, that established persistence through a webshell called emer-run.php by installing a fake plugin. The injected code also manipulated WordPress database queries to hide rogue administrator accounts from the user list, making the compromise harder for site owners to detect from the dashboard alone. Defiant listed the issue as medium severity and unpatched as of publication, according to BleepingComputer. The report also says Defiant’s Wordfence researchers found that command-and-control infrastructure used in the observed attacks points to the same attacker behind recent Advanced Responsive Video Embedder and OptinMonster supply-chain compromises, though that attribution remains based on the single report provided here. The key operational detail is the delivery mechanism: BleepingComputer reports that the attack was API-driven and did not require a plugin update or file modification on the customer site. In the account described by Defiant, the malicious code could run whenever a logged-in administrator accessed a WordPress admin page that loaded the poisoned banner feed. Who benefits: Attackers benefit from a stealthy route into sites where administrators already have valid sessions. The compromise also shows why security vendors monitoring web application firewall traffic can detect supply-chain abuse before site owners notice visible changes. Who's exposed: WordPress sites using the affected BdThemes products are the exposed population identified in the report. The provided BleepingComputer material does not establish exact affected versions or post-publication remediation status.