BdThemes Plugin Attack Exploits JSON to Create Rogue WordPress Admins
A supply chain attack on WordPress plugin vendor BdThemes bypassed code modifications by poisoning JSON files. The breach enabled attackers to create unauthorized admin accounts without altering source code.
TL;DR
- Attackers compromised BdThemes' WordPress plugins via poisoned JSON files.
- No source code was altered in the official WordPress.org repository.
- The exploit allowed creation of rogue admin accounts on affected sites.
- WordPress plugins team disabled downloads during investigation.
- Sites using BdThemes plugins should audit admin accounts immediately.
Cybersecurity researchers have uncovered a sophisticated supply chain attack targeting BdThemes, a popular WordPress plugin vendor. Unlike typical compromises that involve篡改 source code, this attack leveraged maliciously crafted JSON files to gain unauthorized administrative access to WordPress sites.
The attack prompted WordPress's plugins team to temporarily disable all BdThemes plugin downloads while investigating the breach. Security firm Wordfence confirmed that no source code files within the official WordPress.org repository were modified, highlighting the stealthy nature of this compromise.
Organizations using BdThemes plugins are advised to immediately audit their WordPress installations for unauthorized administrator accounts and monitor for suspicious activity.
Attack Vector Analysis
- Attackers exploited JSON file manipulation rather than direct code injection
- The method bypassed traditional code-signing and repository integrity checks
- Compromised JSON data enabled automatic creation of administrator-level user accounts
- No alterations were made to PHP source files in the official repository
- Attack demonstrates evolution toward configuration-based supply chain compromises
Security Response and Mitigation
- WordPress plugins team immediately disabled all BdThemes plugin downloads
- Site administrators should check for unauthorized admin accounts in wp-admin
- Affected installations may require manual removal of malicious user entries
- Organizations should review user creation logs for suspicious administrator additions
- Security teams should monitor network traffic for unusual admin panel activity
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.