Poisoned JSON Feed Created Hidden WordPress Admin Accounts

A WordPress logo rendered over website code — illustrating the plugin ecosystem through which this compromise reached site dashboards. Photo by viarami on Pixabay

CYBERSECURITY · 11 Aug 2026 —

SAN FRANCISCO, 11 AUG 2026 — The attackers did not need to ship a malicious plugin update. The plugins were already installed, and they were already fetching a file from a server the attackers had write access to.

BdThemes makes premium WordPress plugins with more than 350,000 active installations across its portfolio, Element Pack alone accounting for over 100,000. Attackers reached the company's storage bucket, poisoned a JSON feed those plugins pull into the WordPress administrator dashboard, and used it to create hidden administrator accounts.

The chain

March 2026The vulnerable JSON-parsing code is introduced.

23 JuneEarliest date attacks could have begun.

7 AugustWordfence detects the attacks through its firewall.

8 AugustWordPress.org removes the affected plugins pending investigation.

The affected plugins are Element Pack, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste and Smart Admin Assistant. The poisoned stream fed Biggopti, an internal promotional-banner system shared across the range, and the mechanism was a cross-site scripting flaw in its JSON parsing: attacker-controlled content was rendered in an administrator's browser, executing JavaScript with an administrator's session.

The executed JavaScript was sophisticated: it created administrator accounts, installed webshells, and then manipulated the database queries behind the user list to hide those accounts from view. Wordfence, the team at Defiant that found this, describes the hiding as making the compromise materially harder to spot.

The webshell is as durable a threat as the rogue account. An administrator can be deleted, but the webshell is a file that persists, which is why remediation must go beyond the user table.

Their analysis also links the command-and-control infrastructure to the people behind the earlier OptinMonster and Advanced Responsive Video Embedder compromises. The two poisoned endpoints now return clean JSON. As of the reporting, BdThemes had published no statement.

Wordfence's own summary makes the sharpest point available: the sites were compromised without a single line of plugin code being changed. Nothing in the WordPress.org repository was altered, so every integrity check that looks at plugin files returns a pass.

Why this is not an ordinary plugin compromise

The usual WordPress supply-chain story involves a malicious update from a compromised developer account, where the defense is cautious updating and careful review of changes.

Neither defense helps here. The compromise did not arrive in a plugin update, but through a feature working as designed: a plugin fetching remote content from its vendor to display in the admin dashboard.

That pattern is close to universal in commercial WordPress plugins. They check for licence validity, they show promotional notices, they pull changelogs and news panels into the dashboard. Every one of those is a live channel from the vendor's infrastructure into an administrator's browser, open on the site's highest-privilege screen.

The vendor's storage bucket is therefore part of your site's attack surface, and nothing in the WordPress permission model expresses that.

The hidden-account trick is the expensive part

Creating a rogue administrator is routine; hiding it from the user list is what makes an incident persistent.

The standard response to a suspected WordPress compromise is to look at Users, check for accounts you do not recognise, remove them and rotate passwords. That procedure returns a clean result here even while the attacker holds access — and a clean bill of health is what prematurely ends an investigation.

So the practical advice for anyone running these plugins is that the administrator screen is not evidence. Query the database directly for accounts with administrator capability and compare that list against the one the dashboard shows. A discrepancy is the finding.

What site owners should do

If you ran any of the seven affected plugins between late June and 8 August, assume exposure. The time window, not the presence of symptoms, is what matters.

Check for administrator accounts at the database level rather than in the interface. Then rotate credentials for every legitimate administrator, invalidate sessions, and search the filesystem for recently modified or unexpected PHP files, because webshells were part of this payload and a webshell survives deleting the account that placed it. Review scheduled tasks for the same reason.

The plugins were pulled from WordPress.org pending investigation, which means they are not currently updating. Anyone waiting for a fixed version is waiting on a vendor that has not yet said anything publicly.

What to watch

Whether BdThemes publishes an account of what happened to its storage bucket. The write access is the origin of this and nothing about it has been explained.

Whether the same actors reappear. The infrastructure links to two previous plugin compromises suggest a group working this niche repeatedly, and the technique they used here transfers to any plugin that renders remote content in the dashboard.

And whether WordPress tightens what plugins may render in an administrator screen. Such a change would address this entire class of vulnerability, not just this instance, but would likely be unpopular with vendors.

Kenji Tanaka’s Verdict Developer Tools & Cloud

The detail that should change somebody's architecture this week is that no update was published. Every instinct the industry has built about plugin supply chains points at the release process, and this went around it entirely: a JSON file on a vendor's bucket, rendered into the admin dashboard, executing as the administrator. If you sell a WordPress plugin, you are almost certainly doing the same thing for licence checks or a changelog panel, and your object storage is now part of your customers' attack surface whether or not you have ever thought of it that way. For site owners the actionable part is smaller and more urgent. Do not check the Users screen and conclude you are fine, because the entire point of this payload was to make that screen lie. Query the database for accounts with administrator capability and compare. If those two lists disagree, you have your answer, and if you never look you will get a clean result either way.

Sources & cross-checks

Primary: BleepingComputer, 10 August 2026 — for the compromise of BdThemes premium WordPress plugins including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery and Ultimate Store Kit; Element Pack's 100,000-plus active installations and the developer's report of more than 350,000 active installs across the portfolio; attackers gaining write access to BdThemes' storage bucket and poisoning a remote JSON feed delivered to administrator dashboards; the cross-site scripting flaw in the Biggop Library's JSON parsing used to inject JavaScript creating hidden rogue administrator accounts; Wordfence's description of the injected code manipulating WordPress database queries to hide those accounts from the user list; the timeline of vulnerable code introduced in March 2026, an earliest attack date of 23 June, Wordfence detection on 7 August and WordPress.org removing the plugins on 8 August; the attribution of the command-and-control infrastructure to the actors behind the OptinMonster and Advanced Responsive Video Embedder compromises; and the absence of any statement from BdThemes.
Also primary: Wordfence's own advisory, August 2026, for being alerted to the campaign on 7 August; the compromise creating rogue administrator accounts and installing webshells without modifying a single line of plugin code; the poisoning of a static remote JSON stream fetched by an administrative promotional banner component after the attacker obtained write access to the vendor's storage bucket; the naming of that component as Biggopti and the fuller plugin list including Live Copy Paste and Smart Admin Assistant; the March 2026 introduction of the flawed JSON-parsing code; the earliest possible campaign start of 23 June; and the two poisoned API endpoints now returning clean JSON.
What could not be established: ⚠️ We could not establish how many sites were actually compromised as opposed to exposed, how the attackers obtained write access to the storage bucket, whether the plugins have since been fixed or restored, whether BdThemes has notified customers, or whether any specific site has been confirmed breached. ⚠️ We did not read Wordfence's technical write-up directly and rely on a secondary account of it. We sought comment from neither BdThemes nor Defiant.
Method and limits: Compiled 11 August 2026. The argument that this bypasses the update-centred defences the industry has built, the observation that licence checks and dashboard notice panels make a vendor's object storage part of the customer's attack surface, the point that the standard Users-screen check returns a false clean result here, and the remediation sequence recommended are RECATOOLS analysis rather than claims made by any source. This is defensive security reporting: no payload, indicator or reproduction detail appears here beyond the published description of the mechanism.

Tags: #Cybersecurity #Supply-Chain-Security #Data-Breach

Cyber Team

Cybersecurity Desk

Cyber Team is RECATOOLS’ cybersecurity desk, covering vulnerabilities, breaches, threat intelligence, and practical security guidance.

View author profile → · Editorial policy

About this byline Cyber Team is a specialist RECATOOLS editorial desk focused on cybersecurity coverage. Articles are produced and reviewed under RECATOOLS editorial supervision.

Corrections policy