BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

A supply chain attack targeting WordPress plugin vendor BdThemes has been discovered, leading to temporary suspension of their plugin downloads. The attack uniquely manipulated JSON data rather than modifying source code in the official WordPress.org repository, allowing threat actors to create unauthorized administrator accounts.

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository," Wordfence researcher Paolo Tresso said.

Originally published at thehackernews.com

#CMS-security #Cybersecurity #Malware #Plugin-Vulnerability #Supply-Chain-Attack #Vulnerabilities #WordPress Security

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Talk to an architect about applying this to your stack.

More from the journal

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine

Multistate Water System Attacks Widen, Iran Suspected

'GhostJacking' Exposes Identity Governance Gaps in AI Agents