Cybersecurity researchers have uncovered a sophisticated supply chain attack targeting BdThemes, a prominent WordPress plugin vendor whose products are used across thousands of websites. The attack stood out for a novel technique: rather than modifying plugin source code, the threat actors poisoned JSON configuration data served alongside the plugins — a method that evaded most traditional integrity checks.
The WordPress plugins team has responded by temporarily disabling downloads of affected BdThemes products while the investigation continues.
What Happened
According to researchers, the attackers compromised a component of BdThemes' plugin distribution infrastructure and injected malicious payloads into JSON files that plugins fetched at runtime. These JSON files contained crafted data that, when processed, triggered the silent creation of rogue administrator accounts on affected WordPress installations.
The technique is notable because:
- No source code was modified — making static analysis and file-integrity checks ineffective
- The payload was delivered dynamically — appearing only when the plugin phoned home for configuration updates
- Administrative access was granted covertly — installed sites showed no obvious signs of compromise until accounts were discovered
Why This Matters
WordPress powers over 40% of the web, and supply chain attacks against plugin vendors represent a force multiplier for attackers. Rather than compromising individual sites one-by-one, a single vendor breach can cascade to thousands of installations simultaneously.
This attack joins a growing list of software supply chain incidents where the integrity of the distribution pipeline — not the code itself — becomes the vector. Similar tactics have been observed in npm package compromises and PyPI poisoning campaigns.
Scope and Impact
The WordPress plugins team confirmed the temporary suspension of BdThemes downloads as a precautionary measure while auditing the full extent of the compromise. Site owners using BdThemes products are advised to:
- Audit administrator accounts — look for unfamiliar accounts created recently
- Review plugin activity logs — check for unexpected JSON fetch requests
- Disable or temporarily remove affected BdThemes plugins until clean versions are confirmed
- Rotate credentials for all WordPress admin accounts as a precaution
Broader Takeaway
This incident illustrates why supply chain security must extend beyond source code. JSON configuration files, CDN-hosted assets, and remote update mechanisms are all potential injection points that attackers are increasingly targeting. Organizations should consider monitoring outbound plugin update requests and validating the integrity of dynamically fetched data.
The BdThemes compromise adds to mounting pressure on the WordPress ecosystem to implement stronger plugin signing and distribution controls.
Source: The Hacker News