BdThemes Hack: Check Your Site for Rogue Admins

Last updated: August 20, 2026

The BdThemes hack is a supply-chain attack that poisoned a JSON feed BdThemes plugins load from the vendor’s own API, injecting JavaScript into WordPress admin dashboards to create hidden administrator accounts and install a webshell. More than 350,000 sites were exposed, and no plugin update or file change on disk was required.

What is the BdThemes supply-chain attack?

It is an attack in which a threat actor compromised BdThemes’ upstream infrastructure and modified a remote JSON feed that its Elementor add-ons fetch to display promotional banners. When a logged-in administrator opened wp-admin, the poisoned response executed script in their browser and used their own session to create a rogue admin account.

The critical detail for site owners: nothing on your server had to change. Wordfence notes the attack is driven entirely through the API response, so file-integrity scanners that only compare plugin files against the WordPress.org repository will show everything as clean. Wordfence Threat Intelligence was notified of the incident on August 7, 2026.

The underlying weakness is a cross-site scripting flaw in the Biggop Library, the shared component BdThemes plugins use to fetch and render those banners. According to BleepingComputer (August 2026), Wordfence rated the underlying vulnerability medium severity — the impact came from who controlled the feed, not from the bug’s own score.

Which BdThemes plugins are affected?

Seven BdThemes products that bundle the Biggop Library are affected, led by Element Pack Addons for Elementor with more than 100,000 active installations. Combined, the affected plugins account for over 350,000 active installs. All were temporarily pulled from the WordPress.org repository on August 8, 2026 pending review.

Plugin	Reported installs	Notes
Element Pack Addons for Elementor	100,000+	Largest affected product
Prime Slider Addons for Elementor	Not individually disclosed	Vulnerable code first shipped in v4.1.9 on March 1, 2026
Ultimate Post Kit	Not individually disclosed	Bundles Biggop Library
Ultimate Store Kit	Not individually disclosed	Bundles Biggop Library
Pixel Gallery Addons for Elementor	Not individually disclosed	Bundles Biggop Library
Live Copy Paste	Not individually disclosed	Bundles Biggop Library
Smart Admin Assistant	Not individually disclosed	Bundles Biggop Library
Combined	350,000+	All removed from WordPress.org on August 8, 2026

BdThemes had not published an official statement at the time the first reports ran. If you use any plugin in this table, treat your site as in scope for investigation even if it looks normal.

How did attackers create rogue admin accounts?

The poisoned feed delivered a JavaScript payload named w2.js, which ran inside the administrator’s authenticated browser session and contacted the command-and-control host ia-cdn[.]com. It then created a new administrator account through the WordPress REST API or the normal user-creation workflow, and installed a fake plugin carrying the emer-run.php webshell.

Because every request came from a real logged-in admin session, the actions look legitimate in most logs. The chain runs like this:

1. An administrator loads any wp-admin page while a BdThemes plugin is active.
2. The plugin fetches promotional banner data from the vendor’s API endpoint.
3. The poisoned JSON response is parsed unsafely by the Biggop Library, executing attacker script.
4. w2.js profiles the site and decides whether to proceed.
5. A hidden administrator account is created using the victim’s own session.
6. A fake plugin containing emer-run.php is installed for persistence the attacker can call directly.

Researchers have linked the command-and-control infrastructure to earlier compromises involving OptinMonster and Advanced Responsive Video Embedder, which suggests an actor running a broader campaign against WordPress plugin vendors rather than a one-off intrusion.

How do I check if my site was compromised?

Check three things in order: administrator accounts created since June 23, 2026, the presence of emer-run.php anywhere under your web root, and any file or database reference to ia-cdn. June 23 is the earliest date researchers place the attack, so any admin account newer than that needs to be explained.

If you have WP-CLI and SSH access, these four commands cover the essentials. Run them from your WordPress root.

# 1. Every administrator, with the date the account was created
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# 2. Hunt the webshell anywhere under the web root
find . -type f -name "emer-run.php"

# 3. Any file referencing the command-and-control host
grep -rl "ia-cdn" wp-content/ 2>/dev/null

# 4. Plugins you did not install yourself
wp plugin list --fields=name,status,version

No shell access? Do the same checks in the dashboard: Users → All Users → Administrator, then sort by registration date, and use a file scanner from a reputable security plugin to search for the webshell filename. Our guide to the best WordPress security plugins covers which scanners detect webshells rather than only comparing core checksums.

One caveat worth stating plainly: a clean result here is reassuring but not proof. The payload decided selectively which sites to process, so an unaffected site and a site the attacker skipped look identical from the outside.

What do I do if I find a rogue admin or webshell?

Treat the site as fully compromised. A webshell means the attacker could run arbitrary PHP, so removing the account alone is not enough. Work in this order: cut access, remove persistence, rotate every credential, then verify. Do not skip credential rotation — it is the step most people leave out.

1. Deactivate the affected BdThemes plugins immediately.
2. Delete the rogue administrator accounts and reassign any content they own.
3. Delete the fake plugin directory containing emer-run.php.
4. Force a password reset for every remaining administrator, and revoke all application passwords.
5. Rotate database credentials and your WordPress salts in wp-config.php to invalidate stolen sessions.
6. Scan again from a clean tool, then watch new user registrations for a week.

The full cleanup procedure — including how to verify the shell is actually gone and how to check for scheduled-task persistence — is in our walkthrough on cleaning and securing WordPress after the wp2shell attack. The same method applies here.

Should I keep using BdThemes plugins?

Deactivate them until BdThemes ships a fixed release and the plugins return to WordPress.org. The vulnerability sits in code that runs on every admin page load, and the vendor controls the feed that triggers it. Until the parsing is hardened, an active plugin is a standing dependency on someone else’s server staying uncompromised.

That is the broader lesson. A plugin does not have to be updated to turn hostile — it only has to trust remote data. When you next audit your stack, ask which plugins phone home on admin pages and render what they get back. Our comparison of Wordfence vs Sucuri covers which of the two detects this class of admin-session attack.

Frequently asked questions

Was a CVE assigned to the BdThemes vulnerability?

No CVE had been assigned when the attack was first reported in August 2026. Wordfence classified the underlying cross-site scripting flaw in the Biggop Library as medium severity and noted it remained unpatched at the time of publication.

Does updating the plugins fix it?

Not at the time of writing. The plugins were removed from WordPress.org on August 8, 2026 and no patched release was available. Because the attack is delivered through the vendor’s API rather than plugin files, updating would not have helped anyway — deactivation is the reliable mitigation.

Will a firewall block this attack?

Partly. A web application firewall can flag the resulting admin-creation requests and the webshell, which is how Wordfence detected the campaign on August 7, 2026. It cannot block the poisoned JSON itself, because that response comes from the plugin vendor your site legitimately trusts.

What indicators of compromise should I search for?

Three: the webshell filename emer-run.php, the JavaScript payload w2.js, and network or file references to ia-cdn[.]com. Add any administrator account created on or after June 23, 2026 that you cannot personally account for.

How long were sites exposed?

The vulnerable code shipped in Prime Slider 4.1.9 on March 1, 2026. Researchers place the earliest possible attack activity at June 23, 2026, and detection followed on August 7 — a window of roughly six weeks of active exploitation before public disclosure.

Sources

• BleepingComputer — BdThemes plugins supply-chain hack creates rogue WordPress admins (August 2026)
• The Hacker News — BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins (August 2026)
• GBHackers — WordPress Supply Chain Attack Exploits BdThemes Plugins (August 2026)
• Infosecurity Magazine — WordPress Plugins Compromised Without a Single File Change (August 2026)