Seven WordPress plugins have been used to plant rogue administrator accounts and webshells on live sites without a single plugin file being modified. Instead, attackers poisoned a promotional data feed the plugins load into the admin dashboard.
Wordfence was notified of the compromise on August 7 and published its analysis the following day. It affects BdThemes, an Elementor add-on vendor whose plugins are distributed through the official WordPress.org directory, and all seven have been temporarily closed pending review.
Nothing changed in the repository. The plugins ship a component called Biggopti that pulls promotional banners from the vendor's API, and attackers obtained write access to the object storage bucket behind it, swapping legitimate responses for crafted payloads.
An Unescaped Field in a Banner Notice
The vulnerability was introduced by BdThemes itself. Wordfence traced it through SVN history to March 1, when a script added to Prime Slider began concatenating a field from the remote JSON response directly into an HTML attribute without escaping it.
A neighboring attribute in the same code is escaped correctly, which Wordfence reads as an oversight rather than intent. A sanitizer added in May left the flawed attribute untouched.
Because the script runs on every wp-admin page load, the injected code fires silently in the browser of any logged-in administrator. The vulnerability record rates it 5.4, medium severity, and lists it as unpatched.
Rogue Admins and Hidden Accounts
The payload used the administrator's own session token to create a new administrator through the WordPress REST API, then installed a fake plugin carrying a webshell.
That webshell deployed two persistence modules. One grants unauthenticated administrative access through a URL parameter. The other hooks database queries to hide the rogue accounts from the user list and adjust user counts to match.
A second payload, hosted on BdThemes' own infrastructure, derived administrator credentials from the victim's hostname, meaning responders can compute exactly what to hunt for.
Wordfence linked the C2 domain to the actors behind the Advanced Responsive Video Embedder and OptinMonster compromises of the past two months, and said a payload sitting in the vendor's own bucket points to a serious upstream compromise.
Both endpoints were clean by August 8. Because plugin files were never modified, Wordfence urged site owners to audit database user lists, plugin directories and the options table for indicators of compromise.