Cybersecurity experts have uncovered a sophisticated supply chain attack targeting BdThemes plugins, allowing attackers to inject rogue administrators into WordPress sites without altering source code.

Key Takeaways

  • Supply chain compromise detected in BdThemes WordPress plugins.
  • Attackers utilized JSON poisoning to create unauthorized administrative accounts.
  • No modifications were made to the official source code files in the WordPress.org repository.

In a startling revelation, cybersecurity researchers have identified a highly sophisticated supply chain attack affecting BdThemes, a known vendor of WordPress plugins. The attack is particularly dangerous because it bypasses traditional security screenings by avoiding direct modifications to the software's executable source code.

According to Wordfence researcher Paolo Tresso, the attackers employed a technique known as 'JSON poisoning.' By manipulating the JSON data files, the attackers were able to trick the system into creating 'rogue admins'—unauthorized accounts with full administrative privileges over the infected websites.

Why This Matters

BozokMedia analysis shows that this incident marks a shift in attack vectors. While most security tools monitor for changes in .php or .js files, the manipulation of configuration or data files (like JSON) often goes unnoticed. This exploit leverages the implicit trust users place in official repository updates, turning a routine update into a backdoor for hackers.

"The shift from code injection to data poisoning represents a growing trend in stealthy persistence mechanisms within CMS ecosystems."

The WordPress plugins team acted swiftly by temporarily disabling all downloads for BdThemes to prevent further spread. Site owners are urged to audit their user lists immediately for any unrecognized administrative accounts and to implement strict multi-factor authentication (MFA) to mitigate the risk of unauthorized access.

Did You Know?: Supply chain attacks are among the most feared in cybersecurity because a single breach at the vendor level can compromise thousands of downstream customers simultaneously.

Frequently Asked Questions

Q1: How can I tell if my site was affected?
Check your WordPress 'Users' menu for any administrator accounts that you did not personally create.

Q2: Why wasn't this caught by the WordPress repository?
Because the source code remained unchanged, traditional file-integrity checks did not trigger any alerts.