Introduction
The BdThemes plugins supply-chain hack compromised the upstream infrastructure of the developer, resulting in the creation of rogue admin accounts. This guide will provide a comprehensive overview of the attack, including the affected plugins, the vulnerability, and the remediation steps.
Affected Plugins
The BdThemes plugins affected by the supply-chain hack include Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. The flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs.
Attack Mechanism
The threat actor compromised the upstream infrastructure of BdThemes and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. The affected plugins were no longer available for download after the WordPress Plugins team closed them pending a full review.