WordPress Plugin Supply-Chain Attacks: What the BdThemes Incident Means for Your Site
In This Article:
- Attackers poisoned a trusted plugin update feed
- Rogue admin accounts stayed hidden from owners
- Simple checks and habits reduce this risk
In August 2026, security researchers traced a wave of hidden WordPress admin accounts back to a source most site owners would never have suspected: a routine promotional banner inside their own plugin dashboard. Attackers had compromised the update infrastructure behind several BdThemes plugins, including Element Pack, used on more than 100,000 WordPress sites, and quietly poisoned the data feed that powers that banner. No plugin update was needed and no file on the server changed at first. The moment a logged-in administrator opened their WordPress dashboard, the injected script used that admin's own session to create a new, hidden administrator account.
For Philippine small business owners, freelancers, and agencies running a WordPress site for a shop, a portfolio, or a client, this incident is a useful reminder that even actively maintained plugins can become a delivery channel for an attack that has nothing to do with their own code. Here is what happened, how to check if it affects you, and what actually helps going forward.
If your site uses Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, or Ultimate Store Kit, a supply-chain attack disclosed in August 2026 may have created a hidden administrator account on your site without any file change or plugin update. Open your WordPress Users list and look for accounts you do not recognize, especially ones added since late June 2026. If you use any of these plugins, deactivate them until BdThemes confirms a fix, change your admin passwords, and ask your host to check for a file named emer-run.php. Sites that do not use these plugins were not affected by this specific incident.
Table of contents
The BdThemes Supply-Chain Attack
BdThemes is a WordPress plugin developer whose page-building tools, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit, are used to build layouts, sliders, and online store elements, with a combined install base the developer advertises at over 350,000 active sites. In early August 2026, WordPress security firm Wordfence reported that attackers had gained write access to BdThemes' own infrastructure and modified a small, ordinary-looking JSON data feed, the same one that fetches promotional banners into a plugin's admin dashboard.
A coding flaw introduced back in March 2026 let the attacker's modified feed run malicious JavaScript inside the WordPress admin screen. Because that script executed using the logged-in administrator's own authenticated session, it could quietly create a new admin account and, on some sites, install a hidden webshell file, seen as emer-run.php, disguised as a fake plugin. The code was also written to hide the new account from the normal Users list in wp-admin, so a busy site owner would have little reason to notice anything had changed.
Wordfence traced the attack activity back to August 7, and WordPress.org temporarily pulled the affected plugins from its directory the following day, pending investigation. Forensic analysis suggested the campaign could have begun as early as June 23. As of the most recent reporting reviewed for this guide, BdThemes had not issued a public statement and the underlying flaw remained unpatched, so the safest approach for now is to treat any of the five named plugins as unverified rather than wait for an official fix.
Why This Attack Is Different
Most WordPress security advice, including our own recent coverage of the wp2shell WordPress core vulnerability, focuses on a flaw sitting inside a plugin's own code: you update the plugin, and the risk goes away. The BdThemes incident is a different category of problem, often called a supply-chain attack. The vulnerable code was not sitting on your server waiting for a patch; it was being served live from BdThemes' own servers every time your dashboard checked for a promotional update. Updating the plugin on your own site would not have removed the risk, because the plugin's files never changed. Only the data it fetched from outside did.
That distinction matters because it shifts part of the responsibility away from "did I update on time" and toward "how much do I trust every service my site quietly talks to." It is a reasonable question, not a reason to distrust WordPress itself. The vast majority of the plugin ecosystem, including the tools many Filipino businesses already rely on for stores, forms, and page building, has no connection to this incident.
Signs Your Site May Be Affected
Check Your Active Plugins
Log in to your WordPress dashboard and open Plugins, then Installed Plugins. If you see Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, or Ultimate Store Kit, whether active or simply installed, treat your site as potentially exposed until BdThemes confirms the issue is resolved. If none of these plugins are present, this specific incident does not apply to your site.
Check for Rogue Admin Accounts and Files
Because the injected code was built to hide new accounts from the standard Users screen, a normal glance at wp-admin may not tell you everything.
- Ask your hosting provider or a developer to check the database Users table directly, not only the wp-admin screen
- Search the file system for a file named emer-run.php
- Review admin activity for any logins or account creation you do not recognize since late June 2026
- Look for a plugin listed that you do not remember installing
- Check your hosting access logs for unusual outbound requests
What To Do Right Now
If you run any of the five affected plugins, take these steps today rather than waiting for an official patch:
- Deactivate the affected plugin until BdThemes confirms and ships a fix
- Change every WordPress administrator password, not only your own
- Ask your host to check for and remove the emer-run.php file and any admin accounts you do not recognize
- Revoke and reissue any API keys or application passwords tied to your site
- Log out all other active sessions from your WordPress dashboard
If your site does not use any BdThemes plugin, there is nothing urgent to do beyond the habits below. Treat this as a good moment to build them in, not a reason to worry.
Building Stronger WordPress Security Habits
Supply-chain attacks like this one are becoming more common across the WordPress ecosystem, and investigators have linked infrastructure from this campaign to earlier incidents involving different plugin vendors. The good news is that the habits which help here are the same ones that already protect PH businesses from more everyday risks. A home-based online seller running a WooCommerce store, a freelance web designer managing several client sites, and a small clinic running its own appointment-booking page all benefit from the same three practices.
Assuming an official plugin is safe forever. Even an actively maintained, widely trusted plugin can be compromised upstream, as this incident shows. Keep only the plugins your site actually uses, and remove the rest.
Reusing the same admin password everywhere. A password reused across sites or services turns one weak link into many. Use a distinct password for every WordPress admin account, ideally stored in a password manager.
Never checking who has admin access. Review your Users list every few months, especially after installing anything new, so an account you did not create stands out immediately.
A single trusted plugin feed being compromised does not mean WordPress itself is unsafe. It means backups, malware scanning, and a firewall at the hosting level matter even when every plugin you installed is doing exactly what it is supposed to.
PH site owners on a managed WordPress Hosting plan with an automated firewall, malware detection, and daily backups already have a safety net for exactly this kind of incident, one that does not depend on catching every vendor-side compromise yourself.
Frequently Asked Questions
Do I need to remove BdThemes plugins permanently?
Not necessarily. Once BdThemes and WordPress.org confirm the vulnerability is fixed and the plugins are relisted, you can reactivate an updated version. Until then, deactivating rather than deleting is usually enough, since the risk comes from the live data feed rather than the plugin files themselves. If you already found a rogue admin account or the emer-run.php file, treat the whole site as compromised and follow full cleanup steps with your host, not just a plugin swap.
How is this different from a normal WordPress plugin vulnerability?
A typical plugin vulnerability lives in code sitting on your own server, so updating the plugin removes the risk. This attack came from data the plugin fetched live from the vendor's own servers, which is why updating alone would not have helped since the fix has to happen upstream, at BdThemes. Related coverage on this blog, like our wp2shell WordPress vulnerability guide, covers the more common patch-now scenario.
My site does not use any BdThemes plugin. Should I still worry?
No immediate action is needed for this specific incident. It is still a useful prompt to review which plugins are active on your site, remove ones you no longer use, and confirm your hosting plan includes a web application firewall and malware scanning, protections that matter regardless of which vendor is affected next time.
How can I tell if an admin account was created by an attacker?
Compare every account in your Users list against people you actually gave access to, and check each account's registration date. Because this attack's code was written to hide new admin accounts from that screen, also ask your host or developer to check the wp_users database table directly rather than relying on the dashboard view alone.
The BdThemes incident is a reminder that WordPress security is not only about keeping plugins updated. It is also about trusting, and periodically checking, the outside services those plugins quietly connect to. For most Philippine site owners, the practical takeaway is simple: know which plugins are actually active on your site, check your admin user list every so often, and make sure backups and basic server-side protection are already in place before you need them. None of that requires deep technical expertise, and it protects you against far more than just this one incident. If you run any of the affected plugins, take the steps above today. If you do not, use this as a nudge to build the habit anyway.
Get a web application firewall, malware detection, and daily backups working quietly in the background of your WordPress site.
View Hosting Plans