BdThemes Supply Chain Creates Rogue WordPress Admins

BdThemes — the developer behind a suite of premium WordPress web-design plugins — had its upstream infrastructure compromised. According to BleepingComputer, attackers modified a remote JSON feed that BdThemes software fetches and delivers to administrators’ browsers. That feed was weaponized to create unauthorized administrator accounts on WordPress sites running affected BdThemes products.

No CVE has been assigned as of this writing.

What actually happened

The attacker didn’t touch the plugin code you installed. They compromised the remote data feed the installed plugin pulls at runtime — a different layer entirely. Sites that loaded the malicious feed received instructions that created a rogue admin account silently, without any interaction required from the site owner beyond having the plugin active and running.

This matters because your standard defenses don’t catch it cleanly. You can integrity-check the plugin ZIP, verify the plugin checksums against WordPress.org, and come up clean — the plugin itself was fine. The problem was in what it fetched after installation.

Affected plugin names and the exact exposure window are detailed in BleepingComputer’s reporting.

What to do

Three things, in order of urgency:

1. Audit your WordPress administrator accounts right now. Go to Users → All Users, filter by Administrator role, and verify every account is one you recognize. An attacker-controlled admin account doesn’t announce itself — it sits alongside your legitimate accounts and looks identical unless you check.

2. Delete any account you don’t recognize, then assume further compromise. A rogue admin can install additional backdoors, add malicious plugins, exfiltrate your database credentials, or modify existing plugin code. If you find an unauthorized account, treat the site as compromised and rotate credentials: WordPress admin password, database password, and any API keys or service credentials stored in the site config.

3. Update all BdThemes plugins. BleepingComputer reports the vendor is aware of the incident. Monitor BdThemes’ official channels and the WordPress.org plugin pages for security releases addressing the compromised feed infrastructure.

The broader pattern

Plugins that fetch remote configuration, feature flags, or update manifests at runtime are an attack surface that most WordPress hardening guides don’t address. Traditional plugin security reviews focus on the code you install; this attack exploited what that code subsequently fetched.

This is the same supply-chain pattern seen in the BdThemes case more broadly in the open-source ecosystem — the pivot point moves one level upstream from where defenders are watching.

Track active supply-chain incidents on our Supply Chain hub.