The standard advice for a safe WordPress site is simple: keep your plugins updated. This week showed how that advice, on its own, can quietly fail. Attackers backdoored sites running popular BdThemes plugins without changing a single line of plugin code. Sites that were fully patched, with every file exactly as WordPress.org shipped it, were compromised anyway. If your business website runs on WordPress, this one is worth understanding, because the lesson applies far beyond these particular plugins.
What happened
On August 7, security firm Wordfence was alerted to a compromise affecting BdThemes, a popular maker of add-ons for the Elementor page builder. Seven of its plugins were involved, including several with very large install bases: Element Pack Addons for Elementor, Prime Slider, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant. All seven were temporarily pulled from WordPress.org for review.
Here is the twist that makes this notable. The attackers never touched the plugin code in the WordPress.org repository. Instead, these plugins fetch promotional banners from a remote feed hosted by the vendor, a simple JSON data stream sitting in cloud storage. The attackers gained write access to that storage and swapped the legitimate promo data for a malicious payload. Because of a flaw in how the plugin handled that data, one of the fields was injected straight into the WordPress admin dashboard and ran in the browser of any logged-in administrator who loaded the page.
What the attack did
Running inside the administrator's own browser session, the injected code used that admin's session to quietly create a new administrator account through WordPress's own API. It then installed a fake plugin carrying a webshell, and set up two forms of persistence: a "magic login" backdoor that grants administrator access to anyone who visits a special URL, and a second component that hides the rogue accounts from the normal user list and fudges the user count so nothing looks out of place. In short: silent admin takeover, a hidden way back in, and cover to stay unnoticed.
Why "just update" was not enough
This is the part that matters for every small business, not only BdThemes users. Because no plugin file was ever modified, the usual defenses looked green. Your plugins reported as up to date. A file-integrity scan comparing your files to the official versions would find nothing wrong, because your files genuinely matched. The compromise lived in data pulled from a third party at runtime, not in the code on your server. It is a supply-chain attack: the weak point was not your site or the plugin code, but a piece of infrastructure the plugin quietly trusted.
What to do
If your site runs any BdThemes or Elementor add-ons, treat this as urgent, but the checks are worth running on any WordPress site:
- Audit your administrator accounts. Look at the full user list in your database, not just the WordPress dashboard, since the attack hid accounts from the dashboard view. Anything you do not recognize, especially odd usernames, is a red flag.
- Update the affected plugins to the fixed versions, or deactivate and remove them until you have confirmed your site is clean.
- Check for unexpected plugins and files, and review the WordPress options table for entries you cannot explain. A qualified person should confirm the site is clean rather than assuming an update fixed it.
- Have someone actually watching. The sites that catch this fast are the ones with monitoring and a person responsible for the website, not the ones checking in once a year.