A supply chain attack targeting WordPress plugin vendor BdThemes resulted in malicious JSON file modifications that created unauthorized administrator accounts on affected websites, Wordfence researchers disclosed this week.
The attack bypassed typical detection methods by leaving all source code files intact within the WordPress.org repository. Instead, attackers manipulated JSON configuration files associated with BdThemes plugins, a technique that evaded standard code review processes. Wordfence researcher Paolo Tresso noted that this approach differed fundamentally from traditional supply chain compromises, which typically involve modifying source files directly.
The compromised JSON files contained instructions that generated rogue WordPress administrator accounts upon plugin activation or during routine site updates. Site owners discovered unauthorized admin accounts with suspicious usernames and credentials that attackers could use to maintain persistent access, modify site content, install additional malware, or extract sensitive data.
BdThemes, a major vendor of WordPress themes and plugins, serves thousands of websites. The scope of the attack remains under investigation, but early indicators suggest multiple plugin variants were affected. The WordPress plugins team responded by temporarily disabling downloads of compromised BdThemes plugins from the official repository to prevent further installations.
This attack highlights a critical vulnerability in how WordPress extensions distribute updates. JSON configuration files often receive less scrutiny than source code during security reviews. Many automated scanning tools focus on executable code patterns rather than configuration file integrity. Attackers exploited this gap systematically.
Site administrators using BdThemes plugins should immediately review their user accounts for unfamiliar administrator profiles. Wordfence recommended checking WordPress user lists for newly created accounts with unusual creation dates or unfamiliar email addresses. Organizations should also review administrative action logs to identify when unauthorized accounts accessed their sites.
The incident raises questions about WordPress.org's update verification mechanisms. While the repository signs plugin packages cryptographically, the process does not guarantee that every file within a plugin receives equal security scrutiny. Configuration files, data directories, and other non-code assets sometimes bypass detailed review.
BdThemes has committed to investigating how attackers gained access to their build or distribution systems. Preliminary findings suggest the attack occurred at the vendor's infrastructure level rather than through compromised developer credentials alone. This distinction matters for remediation efforts.
WordPress users should take immediate action: update all BdThemes plugins once security patches become available, verify no unauthorized accounts exist on their installations, review audit logs for suspicious administrative activity, and consider implementing additional access controls such as two-factor authentication on WordPress administrator accounts.
The attack demonstrates that supply chain threats do not always follow predictable patterns. Organizations cannot rely solely on source code integrity verification. Configuration files, build artifacts, and distribution mechanisms require equivalent security attention. Third-party plugin dependencies deserve the same scrutiny as first-party code.