MalwareBleeping Computer
6.0 — HIGH
BdThemes plugins supply-chain hack creates rogue WordPress admins
A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create rogue admin accounts. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A threat actor compromised BdThemes' upstream infrastructure, modifying a remote JSON feed to create rogue WordPress admin accounts, exploiting a cross-site scripting (XSS) vulnerability in the Biggop Library's JSON response-parsing code.
⚙️Technical Details
💥Impact Assessment
Severity: Medium
Who Is at Risk
WordPress administrators with active Element Pack plugin installations
🛡️Recommended Actions
1Monitor WordPress admin activity for suspicious user behavior
2Implement a web application firewall (WAF) to block malicious API requests
3Regularly update and patch WordPress plugins and themes
📦Affected Products
Element Pack pluginPrime Slider pluginUltimate Post Kit pluginPixel Gallery pluginUltimate Store Kit plugin
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.