Rogue Administrator Accounts and Webshells Planted Through WordPress Plugins
In a significant security breach, seven WordPress plugins have been exploited by attackers to create rogue administrator accounts and deploy webshells on live websites, all without altering any plugin files. The attackers utilized a clever method of poisoning a promotional data feed that the plugins relied on to load into the admin dashboard. This method allows the intruders to bypass traditional security measures that generally focus on file changes, making this incident particularly concerning for website administrators.
The cybersecurity firm Wordfence became aware of the compromise on August 7 and subsequently published a detailed analysis the following day. The vulnerable plugins are part of the BdThemes ecosystem, a vendor that specializes in add-ons for Elementor and has its offerings distributed via the official WordPress.org directory. Following the discovery of the breach, all seven affected plugins have been temporarily taken offline for review.
Upon investigation, Wordfence revealed that no actual changes were made to the repositories of these plugins. Instead, the exploit was rooted in a component called Biggopti, which is designed to pull promotional banners from BdThemes’ API. Attackers managed to gain write access to the object storage bucket behind this API, effectively swapping legitimate responses with malicious payloads. This tactic underscores the evolving nature of cybersecurity threats, particularly in supply chain vulnerabilities.
The Source of the Vulnerability
The vulnerability can be traced back to BdThemes itself. Wordfence conducted a thorough analysis through the Subversion (SVN) history and pinpointed the introduction of the flaw to March 1. On that date, a script added to the Prime Slider plugin began to concatenate a field directly from a remote JSON response into an HTML attribute without applying any escaping measures. Interestingly, a neighboring attribute in the same codebase was correctly escaped, leading Wordfence to conclude that this was more likely a coding oversight than an intentional negligence.
In May, a sanitizing measure was introduced; however, it failed to address the problematic attribute, leaving it vulnerable. The implications of this oversight are severe, as the script executes on every page load in the WordPress admin dashboard. Consequently, the malicious code silently activates in the browsers of any logged-in administrators, creating a long-term vulnerability that remains unpatched. This severity is classified by vulnerability records as a medium threat (5.4 rating).
The Mechanism of Exploitation
Once the malicious payload was executed, it utilized the current session token of an administrator to generate a new administrator account via the WordPress REST API. Following this step, the attackers installed a counterfeit plugin that contained a webshell. This webshell incorporated two persistence modules, one of which allows unauthorized administrative access through a specific URL parameter. The second module is more insidious, as it intercepts database queries to conceal the rogue accounts from standard user listings while manipulating user counts to reflect only the legitimate accounts.
Furthermore, a secondary payload was identified on BdThemes’ infrastructure, which extracted administrator credentials based on the victim’s hostname. This allows responders to pinpoint the exact details needed for investigations and remediation efforts.
Wordfence has attempted to connect the dots, noting that the command-and-control (C2) domain linked to this incident bears similarities to previous compromises involving the Advanced Responsive Video Embedder and OptinMonster, both occurring within the last two months. The presence of a malicious payload residing within BdThemes’ own storage further suggests a troubling upstream compromise that has far-reaching implications.
By August 8, both compromised endpoints were reportedly sanitized; however, due to the nature of the exploit—where plugin files were left intact—Wordfence has taken proactive measures to advise site owners. They recommend conducting thorough audits of database user lists, scrutinizing plugin directories, and reviewing the options table for any indicators of compromise. Given the sophistication of these types of attacks, vigilance is paramount for website administrators looking to protect their assets and maintain the integrity of their web environments.