Poisoned banner feed turns BdThemes WordPress plugins into rogue-admin factories

Researchers at Wordfence found that attackers compromised the upstream infrastructure of BdThemes, a popular WordPress plugin vendor, and poisoned a remote JSON feed that its plugins fetch to show promotional banners in the admin dashboard. Because the malicious code lives in that feed rather than in the plugin source, no plugin update was needed and nothing changed on disk. The injected script runs in every logged-in administrator's browser, creates hidden rogue admin accounts through the site's own interface, and installs a fake plugin containing a web shell for persistence. Seven plugins including Element Pack and Prime Slider were affected, and the flaw sat unnoticed for about five months.

Check

If you run BdThemes plugins such as Element Pack or Prime Slider, check for unexpected administrator accounts and unfamiliar plugins, and look for a web shell file named emer-run dot php.

Affected

WordPress sites running affected BdThemes plugins; a poisoned vendor feed ran code in administrators' browsers to create hidden admin accounts and install a web shell, without any plugin update or on-disk change.

Fix

Update the plugins once cleaned versions ship, remove rogue admins and web shells, rotate administrator credentials, and treat remote content that plugins load into the dashboard as an attack surface to monitor.