BdThemes plugins hijacked via poisoned API, spawning rogue WordPress admins
Wordfence uncovered a supply‑chain attack on BdThemes where threat actors poisoned a static JSON feed used by the plugins’ admin banner component. The malicious payload creates hidden administrator accounts and can drop web‑shells, giving attackers full control of affected sites. All affected plugins were temporarily removed from the WordPress repo pending fixes.