Somewhere, a marketing team at a plugin company thought a little promotional banner in the WordPress dashboard would be a harmless way to cross-sell upgrades. Attackers thought it would be a great place to hide a skeleton key. Guess who won this round.

The Banner Wasn't the Problem. Its Data Feed Was.

Researchers discovered that plugin vendor BdThemes got hit with a supply chain compromise that didn't touch a single line of plugin source code. Instead, attackers exploited a cross-site scripting flaw (CVSS 5.4) in a shared component called Biggopti, which pulls promotional banner content from a JSON file sitting in a DigitalOcean Spaces bucket. Once attackers got write access to that bucket, they swapped the legitimate JSON for a malicious payload — meaning every site loading that "harmless" banner was quietly downloading attacker-controlled JavaScript.

Seven BdThemes plugins were pulled from WordPress.org on August 7-8, 2026, including Element Pack Addons, which alone has north of 100,000 active installs. The payload — a script charmingly named w2.js — created rogue administrator accounts, dropped a web shell, and phoned home to a command-and-control server. A second variant generated deterministic backdoor credentials based on each site's hostname, which is the kind of detail that should make any dev team's stomach drop.

Your Supply Chain Is Only as Trustworthy as Its Weakest JSON File

This is the part that should worry site owners more than any individual CVE: nobody had to find a bug in your code. They found a bug in a bucket your plugin trusted, and that trust became the exploit. Every "phone home for updates" feature, every remote config fetch, every third-party asset your CMS quietly loads is now part of your attack surface, whether you audited it or not.

Most people mentally file "supply chain attack" under SolarWinds-style, nation-state, once-in-a-decade events. This one ran through a promotional banner. That's the gap between how seriously businesses think about supply chain risk and how casually attackers are now treating it as just another entry point.

If your plugins are quietly fetching content from someone else's cloud bucket, that's not a banner ad — that's a remote code execution vector wearing a costume.

Supply chain risk like this is exactly why we put together a free developer's checklist for locking down third-party dependencies — grab it here before your next plugin update becomes someone else's backdoor.

Source: The Hacker News