Seven popular Elementor add-on plugins from BdThemes were used to plant hidden backdoors on WordPress sites, according to Wordfence. The attackers never touched the plugin code itself. Instead, they broke into the cloud storage BdThemes uses to feed a promotional banner inside its own plugins, and used that banner to run malicious code in your WordPress dashboard.

What happened

BdThemes plugins include a small promotional banner system, called Biggopti, that loads its content from an external data feed. Attackers got write access to that feed and swapped the normal data for a malicious script.

The script exploited a flaw in how the banner displayed an ID value: it inserted that value directly into a page element without cleaning it first. That let attackers sneak in a hidden script that ran automatically the moment an administrator opened their WordPress dashboard.

Once triggered in an admin’s browser, the script contacted an outside server, created a new rogue administrator account through WordPress’s own REST API, and installed a fake plugin containing a webshell, a tool that gives attackers direct control of the site through a hidden file. It also dropped extra backdoor files into WordPress’s “must-use” plugins folder, including one that lets attackers log back in without a password and another that hides the fake accounts from view.

Wordfence traced the earliest signs of the campaign to June 23, 2026, with the last poisoned data pushed on August 6 and 7. The malicious feed was cleaned up on August 8.

Who is affected

Sites running any of these BdThemes plugins should check their site immediately:

  • Element Pack Addons for Elementor
  • Prime Slider Addons for Elementor
  • Pixel Gallery Addons for Elementor
  • Ultimate Post Kit Addons for Elementor
  • Ultimate Store Kit
  • Live Copy Paste for Elementor
  • Smart Admin Assistant

The WordPress Plugins team temporarily closed all seven plugins in the official directory on August 7 while it investigates, so they are not currently available for fresh installs or updates.

What to do now

Log in to your WordPress admin area and check your Users list for accounts you don’t recognize, especially usernames starting with “bd_” followed by six random letters or numbers, or accounts using an @wordpress.org or @developer.wordpress.org email address.

Look through your plugins folder for files named emer-run.php, class-wp-token-validate.php, class-wp-query-*.php, or wp-cache-optimizer.php. None of these belong in a legitimate WordPress install.

If you use Wordfence, run a full scan. Paid Wordfence customers received detection signatures for this attack on August 7. Free Wordfence users get the same signatures after a standard 30-day delay, so a manual file check is worth doing in the meantime if you’re on the free version.

If you find any of the warning signs above, treat the site as compromised: change all administrator passwords, remove any accounts and files you don’t recognize, and consider asking a security professional for help with a full cleanup. Until BdThemes ships a fix and WordPress.org reopens the plugins, keep a close eye on your site if you rely on any of them.

End of article