GoKawiilA threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers to create rogue admin accounts.
Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review.
BdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.
Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs.
WordPress security firm Defiant started seeing attacks through its Wordfence web application firewall (WAF) on August 7.
The researchers say that the attacker "poisoned a static remote JSON data stream fetched by an administrative promotional banner component" after obtaining write access to the vendor's storage bucket.
According to the researchers, the plugin developer had introduced a cross-site scripting (XSS) vulnerability in the JSON response parsing code, allowing the attacker to replace the legitimate promotional JSON with malicious code that exploited the security issue.
The researchers report that the attack was enabled by a coding flaw introduced in March 2026 in the JSON response-parsing code, which created a cross-site scripting (XSS) vulnerability in the BdThemes infrastructure.
The flaw is in the Biggop Library used by the Biggopti component responsible for getting promotional banners from the vendor's API server and showing them in the customers' WordPress admin dashboard.
A report from Defiant explains that the malicious JavaScript injection uses the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites, while an additional payload (w2.js) establishes persistence via a webshell (emer-run.php) by installing a fake plugin.
... continue reading