BdThemes supply-chain hack creates rogue WordPress admins

A supply-chain attack on BdThemes, a developer of premium WordPress design tools, has resulted in unauthorized administrator accounts being created on customer sites. The breach targeted the vendor’s upstream infrastructure, specifically a remote JSON feed delivered to administrators’ browsers during plugin updates or configuration checks.

What happened

Attackers modified the JSON feed to include instructions that generated rogue WordPress admin accounts on sites using BdThemes plugins. The method leveraged the feed’s legitimate delivery mechanism, bypassing traditional file-based malware detection. No details were provided about the number of affected sites, the duration of the compromise, or how the attackers initially gained access to BdThemes’ systems.

BdThemes has not publicly disclosed whether the compromised feed has been secured or if patches have been issued to remove the malicious payload. The vendor also did not confirm whether all affected customers have been notified.

What we don’t know yet

The scope of the breach remains unclear. Sources did not specify how many sites were impacted, whether the attack was targeted or opportunistic, or if additional malicious payloads were distributed beyond the rogue admin accounts. The timeline of the compromise—including when the attackers first gained access and when the tampered feed was active—was also not disclosed. Without further details, it is difficult to assess the full risk to users or the effectiveness of remediation efforts.