Blog BdThemes ecosystem hit by a poisoned API response
BdThemes ecosystem hit by a poisoned API response
A supply-chain compromise in the BdThemes plugin ecosystem is pushing malicious payloads through a poisoned update API response, reaching sites that never installed anything new.
A supply-chain compromise in the BdThemes plugin ecosystem is quietly reaching sites that did nothing wrong. The attack does not require a site owner to install a bad plugin or click a bad link. It rides in through an update-check API response that the plugins themselves fetch, and the response has been poisoned to deliver a malicious payload back to any site running an affected BdThemes product.
That is the part worth sitting with. A site running a legitimate, paid, licensed BdThemes plugin — installed months or years ago from the vendor, updated the usual way — is the target here. The trust boundary being crossed is not the WordPress plugin directory. It is the vendor’s own update channel. Nothing on the site changed. The remote answer to a routine “is there anything new?” call changed, and that was enough.
For anyone running BdThemes plugins on a WordPress site, the practical move is to treat that site as potentially touched: deactivate the affected plugins until the vendor confirms the update channel is clean, look for unexpected admin users and unfamiliar files in wp-content/, and rotate credentials for anything the site can reach. A file-integrity scan against the plugin’s shipped files, comparing what is on disk to what the vendor released, is more useful right now than any behavioural rule.
Supply-chain attacks against paid WordPress plugins are the case where a scanner earns its keep, because the entry point is a file the site owner trusts by name and version. The only defence is looking at what the file actually does.
For sites that want a scanner built to catch exactly this kind of trusted-plugin compromise, Segurium is available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #supply-chain , #malware