Affected Systems

BdThemes WordPress plugins including Element Pack (100,000+ active installs), Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit. All versions using the vulnerable Biggop Library introduced in March 2026. Attack active since at least June 23, 2026. Affects WordPress administrators viewing wp-admin pages.

Exploitation Status

Active exploitation confirmed since June 23, 2026. Wordfence WAF detected attacks starting August 7. Attacker compromised BdThemes' Sigmative API server and poisoned JSON feeds. Attack is fully automated, requires no user interaction, and executes on every wp-admin page load. Linked to same threat actor behind Advanced Responsive Video Embedder and OptinMonster supply-chain attacks.

Business Impact

Attackers gain persistent administrative access to WordPress sites through unauthorized admin accounts and webshell (emer-run.php) installed via fake plugin. Rogue accounts are hidden from WordPress user lists through database query manipulation, making detection difficult. Attack is entirely stealthy—no file modifications or plugin updates required. All affected plugins removed from WordPress.org as of August 8. Vulnerability remains unpatched as of article publication. Organizations running affected BdThemes plugins face immediate risk of full site compromise.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all WordPress administrator accounts for unauthorized users, checking database directly (wp_users and wp_usermeta tables) as rogue accounts are hidden from standard user lists
  • Search WordPress installations for webshell file 'emer-run.php' and fake plugins installed by payload 'w2.js'; remove immediately if found
  • Uninstall all BdThemes plugins (Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, Ultimate Store Kit) until vendor releases patched versions and issues security advisory
  • Review WordPress access logs and database audit logs from June 23, 2026 onward for suspicious administrative activity or account creation
  • Deploy Wordfence WAF or equivalent with rules to block malicious Sigmative API responses if BdThemes plugins cannot be immediately removed