Usina polonesa sofre ataque cibernético via rede celular privada; CERT divulga recomendações

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins  Contact/Tip Us  Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media       RSS Feeds  Email Alerts BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins  Ravie Lakshmanan  Aug 11, 2026 Supply Chain Attack / Vulnerability Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platform’s plugins team to temporarily disable their downloads. “Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository,” Wordfence researcher Paolo Tresso said . “Instead, threat actors poisoned a static remote JSON data stream fetched by an administrative promotional banner component.” The list of affected plugins is below – Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite] – 100,000+ active installs Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste] – 6,000+ active installs Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery [pixel-gallery] – N/A Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons [bdthemes-prime-slider-lite] – N/A Smart Admin Assistant – Dashboard and Site Enhancements [smart-admin-assistant] – N/A Ultimate Post Kit Addons for Elementor [ultimate-post-kit] – N/A Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit] – 6,000+ active installs Users visiting the listings for each of the aforementioned plugins on the WordPress plugins directory are displayed the message that they have been closed as of either August 7 or 8, 2026, and are not available for download pending a “full review.” The issue, per the WordPress security company, is rooted in an internal component called Biggopti that’s shipped along with the plugins. The system is designed to pull promotional banners from their API server and render them in the WordPress admin dashboard by fetching relevant JSON files from a DigitalOcean Spaces bucket. The library has been found vulnerable to a cross-site scripting (XSS) flaw in the JSON response parsing code via the “display_id” parameter from the Sigmative API due to insufficient client-side escaping. As a result, an attacker who can compromise the API can inject arbitrary web scripts in pages that get executed every time a user accesses those pages. Because the script runs on every “wp-admin” page load, the injected code gets activated silently in the browser of any logged-in administrator. The vulnerability is rated 5.4 on the CVSS scoring system, indicating medium severity. The change is said to have been first introduced on March 1, 2026, in “bdthemes-prime-slider-lite” before being applied to others. The attack is notable because it’s entirely driven via the API and requires no plugin updates or files to be modified on disk. “Rogue actors obtained write access to that bucket, replacing the legitimate JSON responses with crafted payloads to exploit that vulnerability,” Wordfence said. “The XSS fires inside every logged-in admin’s browser, silently, on every wp-admin page load. From there, the injected script creates rogue administrator accounts, uploads a web shell plugin, and phones home to a command-and-control (C2) server.” The main payload is delivered to the plugins using the “api-data-all-records” API endpoint. A JavaScript file named “w2.js,” the payload performs the following actions – Contacts the C2 server (“ia-cdn[.]com/fz/c”) with the victim website’s origin to fetch targeting instructions. The execution is aborted if the C2 server returns a “skip” or “done” status. Creates a new rogue administrator via the WordPress REST API. Downloads a fake plugin ZIP from the C2 server and installs it via the standard plugin upload form, resulting in the deployment of a PHP web shell (“emer-run.php”). Invokes the web shell to install two persistence modules into the Must-Use plugins (” mu-plugins “) directory: one is a “magic-login backdoor” that allows unauthenticated administrative entry via a URL parameter (?_wplogin=<token>)by targeting the site’s longest-registered administrator and the other is an anti-analysis stealth module that hooks into WordPress database queries to conceal the presence of the rogue user accounts from the administrative user list and display the total user count by excluding them. An alternate payload (“x.js”) found hosted on the plugin developer’s infrastructure is served to victims using the “api-data-records” API endpoint. It’s designed to generate “deterministic” administrative credentials that are mathematically derived from the victim website’s hostname. “This algorithm produces predictable usernames (bd_ followed by a 6-character base36 hash) and passwords (Bd@26! followed by the hash and x), pairing them with an @wordpress.org email address,” Wordfence said. “Because the credentials are deterministic, threat actors do not need to store compromised site lists centrally, and incident responders can compute the exact username and password to hunt for on suspected domains.” The generated credentials are then leveraged to create a malicious administrator user, and the results of the attack are then exfiltrated back to the C2 server. The C2 server used in the campaign is assessed to be related to two other software supply chain attacks involving Advanced Responsive Video Embedder (CVE-2026-18072) and OptinMonster in recent months. In the two cases, the WordPress plugins were backdoored to grant full administrative access to unauthenticated attackers either via a single hard-coded token or a hidden administrator account and a concealed plugin that were created and installed only when a site admin logged in. This indicates that the end goal of the campaign is to establish covert administrative persistence and remote code execution across WordPress environments. “The fact that malicious JSON records and the secondary x.js payload were uploaded directly into the vendor’s own bucket indicates a severe upstream compromise of BdThemes’ cloud storage credentials or internal infrastructure,” Wordfence said. The development comes days after WordPress addressed a pre-authentication reflected XSS flaw ( CVE-2026-64638 aka XSS2Shell, CVSS score: 8.9) that can be exploited to achieve PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE      Tweet  Share  Share  Share   Share on Facebook  Share on Twitter  Share on Linkedin  Share on Reddit  Share on Hacker News  Share on Email  Share on WhatsApp Share on Facebook Messenger  Share on Telegram SHARE  Cloud security , content management system , Cross-site Scripting , Malware , remote code execution , Supply Chain Attack , Vulnerability , Web Security , WordPress ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers New WordPress Pre-Auth XSS Could Lead to PHP Code Execution – Patch ASAP Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders Cybersecurity Webinars Risk in AI-Generated Code How to Secure AI Code Before It Reaches Production Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News Cybersecurity Resources 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On 35 labs plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C. SANS AI Cybersecurity Summit Returns This November Learn how practitioners are applying AI to today’s cybersecurity challenges. ​ Expert Insights Articles Videos AI Agent Lifecycle Risks  August 10, 2026 Read ➝ Agents Work Everywhere Now. Governance Has to See Everywhere Too.  August 10, 2026 Read ➝ The Blind Spot in Modern Email Security  August 10, 2026 Read ➝ How AI-Assisted Attacks Are Breaking Legacy SIEM Tools  August 3, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email