A supply-chain attack on BdThemes, the developer behind widely used Elementor add-ons, quietly created hidden administrator accounts on hundreds of thousands of WordPress sites before researchers caught it. Wordfence discovered the compromise on 7 August and traced it to a poisoned JSON feed — the kind of update-notification data a plugin routinely pulls from a vendor's own servers — served from BdThemes' infrastructure. When an administrator opened their WordPress dashboard, the tampered feed exploited a cross-site scripting flaw in a shared component (introduced back in March) to run malicious JavaScript inside that logged-in admin session.
From there, the injected code created a new administrator account, hid it from the normal Users list by manipulating the underlying database queries, and dropped persistence mechanisms: a PHP web shell named emer-run.php, a fake plugin masquerading as a legitimate WordPress extension, and, according to some researchers, a "magic login" backdoor that grants admin access via a URL parameter with no password at all. Seven BdThemes plugins were affected — including Element Pack (100,000+ installs on its own), Prime Slider, Ultimate Post Kit, Pixel Gallery, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant — roughly 350,000 active installations combined. WordPress.org pulled every affected plugin from its repository on 8 August, and Wordfence has linked the attackers' command-and-control infrastructure to the group behind two earlier plugin compromises, Advanced Responsive Video Embedder and OptinMonster.
What this means for your business
If your website runs on WordPress with Elementor, check now whether any of the affected BdThemes plugins are installed — active or simply present but deactivated, since a dormant copy can still have run the poisoned update check while it was active. Until BdThemes ships a verified clean release, the safest move is to remove the plugin entirely rather than wait for a patch. Then check your admin user list for accounts you don't recognise; because the malware hides itself from the normal Users screen, it's worth asking your host or developer to check the database directly rather than trusting what the dashboard shows. Look too for a file named emer-run.php anywhere in your WordPress install, and for any plugin you don't remember installing. If you find any of these signs, treat the site as compromised: change every admin password, rotate any API keys or secrets stored on the site, and have someone experienced review the server before trusting it again. More broadly, this is a reminder that a plugin update isn't just code — it's a trust relationship with the vendor's own infrastructure, and it's worth knowing which of your site's plugins come from small, single-vendor shops versus teams with a track record of quick, transparent incident response.