A BdThemes supply chain attack disclosed by Wordfence on August 10 is turning a set of popular Elementor addon plugins into rogue admin factories. If your site runs Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, Ultimate Store Kit, Live Copy Paste for Elementor, or Smart Admin Assistant, this is worth checking today rather than the next time you happen to be in the dashboard.
What makes this one unusual is that it doesn’t require an outdated plugin version at all. The attackers didn’t touch any plugin code sitting on your server. They compromised infrastructure on BdThemes’ side instead, which means a site running the newest version of an affected plugin was just as exposed as one running an old one.
How the BdThemes supply chain attack works
Several BdThemes plugins share a component called Biggopti that pulls promotional banner content from a JSON feed hosted on BdThemes’ own cloud storage. According to Wordfence researcher Paolo Tresso, attackers replaced that legitimate JSON response with one carrying a malicious script. Every time a logged-in administrator loaded a wp-admin page on a site with one of these plugins active, the poisoned data executed silently in the browser.
From there, the payload creates a new administrator account through the WordPress REST API and hides it from the normal Users screen, drops a file that acts as a web shell disguised as an installed plugin, and adds a backdoor module to the mu-plugins folder so access survives even after the JSON feed itself gets cleaned up. Wordfence traced confirmed exploitation back to June 23, weeks before this went public.
Which plugins are affected
The plugins named across Wordfence’s advisory and follow-up reporting from The Hacker News and BleepingComputer are:
- Element Pack Addons for Elementor (100,000+ active installs)
- Prime Slider Addons for Elementor
- Ultimate Post Kit Addons for Elementor
- Pixel Gallery Addons for Elementor
- Ultimate Store Kit
- Live Copy Paste for Elementor
- Smart Admin Assistant
All of them were pulled from the WordPress.org plugin directory on August 7 and 8 pending a full review, and as of this writing there’s no patched release to update to. Deactivating is currently the only fix.
What to do if you run any of these plugins
- Deactivate and delete the affected plugin now. Don’t wait for a patched version since none exists yet.
- Check your Users list for any administrator account you don’t recognize, then check the wp_users database table directly, since part of the payload’s job is hiding rogue accounts from the standard admin screen.
- Look for a file installed as a fake plugin, and check the mu-plugins directory for anything you didn’t put there yourself.
- Review access and login logs back to June 23 for anything unusual.
- Rotate your WordPress admin passwords and any API keys visible in the dashboard as a precaution, even if you don’t find obvious signs of compromise.
If you’d rather have someone confirm the site is clean than dig through database tables yourself, that kind of check is exactly what a WordPress Development security review covers, and it’s a natural add-on for anyone leaning on Elementor Development work where these addon plugins tend to pile up over time.
