In a recent cybersecurity incident, BdThemes, a prominent WordPress plugin provider, suffered a supply chain attack that compromised several of its plugins. This prompted the WordPress plugins team to suspend the download of affected plugins temporarily, thereby safeguarding users from potential threats.
Unlike typical supply chain breaches, this attack uniquely involved tampering with a static JSON data stream rather than modifying source code files in the WordPress.org repository, according to Wordfence researcher Paolo Tresso. The unauthorized modification targeted an administrative component that pulls promotional content, thereby injecting malicious scripts.
Affected Plugins and Vulnerabilities
The breach impacted multiple BdThemes plugins, including Element Pack Addons and Live Copy Paste for Elementor, among others. While some plugins have a substantial number of active installations, others have unspecified user counts. Notices on WordPress’s plugin directory indicate closures pending comprehensive reviews.
The vulnerability resides within a component named Biggopti, which fetches promotional banners using JSON files from a DigitalOcean Spaces bucket. A cross-site scripting (XSS) flaw was discovered, attributed to inadequate client-side escaping of data from the Sigmative API. This flaw permits attackers to inject harmful scripts executed during admin page loads.
Attack Mechanics and Payloads
The attack utilized the “api-data-all-records” endpoint to deliver a JavaScript payload termed “w2.js.” This script communicates with a command-and-control (C2) server, potentially creating unauthorized admin accounts and deploying a PHP web shell. Furthermore, it installs persistence modules that facilitate ongoing unauthorized access and conceal malicious activity.
An alternate payload, “x.js,” found on the plugin developer’s infrastructure, generates deterministic admin credentials based on the victim website’s hostname. This method simplifies the attack by eliminating the need for a centralized storage of compromised credentials.
Implications and Future Outlook
This breach underscores significant security concerns within the WordPress ecosystem, highlighting the sophisticated nature of modern supply chain attacks. The campaign’s ultimate objective appears to be establishing covert administrative control and enabling remote code execution across affected websites.
The incident follows closely on the heels of other similar attacks, suggesting a broader trend of targeting WordPress plugins to gain administrative access. The compromised JSON records and payloads point to potential lapses in BdThemes’ cloud storage security or internal infrastructure.
As cybersecurity experts continue to investigate, users are advised to remain vigilant, promptly update affected plugins, and monitor for any unusual activities within their WordPress installations. Ensuring robust security practices and regular audits can help mitigate such risks in the future.
