WordPress Supply Chain Attacks: The Risk You Can't Patch
Four WordPress plugin vendors were compromised in ten weeks. Why keeping plugins updated no longer covers you, and what to ask about your own site.
On August 7, Wordfence published an advisory about seven WordPress pluginsWordPress PluginsWordPress plugins are third-party extensions that add functionality to WordPress sites, and collectively, the platform from a single vendor, BdThemes, whose users were being quietly backdoored. The plugins include Element Pack, Prime Slider, and Pixel Gallery, add-ons for Elementor that run on a lot of small business sites.
One detail should get your attention: the attackers never touched the plugin code. Every version in the WordPressWordPressWordPress is the world directory was clean. Instead, they broke into the vendor’s cloud storage and poisoned the little promotional feed the plugins check when you load your dashboard. The plugins did exactly what they were built to do, phoned home, and came back carrying malware.
If you own a business that runs on WordPress, this incident is worth ten minutes of your time. The seven plugins themselves matter less than the pattern behind them, because the pattern changes how your website risk actually works.
What happened at BdThemes
Like a lot of freemium plugins, BdThemes products fetch promotional banners from the vendor’s servers and display them inside your WordPress admin. It is marketing plumbing. Nobody audits it.
Attackers got write access to the vendor’s cloud storage bucket and replaced those banner responses with crafted payloads. A cross-site scripting flaw in the banner component, present since Prime Slider 4.1.9 shipped on March 1, meant the malicious response executed silently every time an administrator loaded a dashboard page. No click required, no warning shown.
Once running, the script did what modern WordPress malware does. It created a rogue administrator account, with credentials generated from your own site’s hostname. It uploaded a fake plugin containing a webshell, a remote control channel for the attacker. Then it installed two must-use plugins, a special class of plugin WordPress loads automatically and will not show as deactivatable in the dashboard: one a magic login backdoor allowing unauthenticated access, the other a stealth module that hides the rogue admin accounts from your user list. You could open your Users page, see nothing wrong, and be wrong.
Wordfence puts the earliest possible activation in late June. The poisoned endpoints were cleaned on August 8, and the plugins were temporarily closed on the WordPress directory while the investigation continues. The advisory includes the indicators to check, and I have summarized them at the end of this post.
The fourth vendor compromise in ten weeks
If this were one vendor having a bad month, I would not be writing about it. It is the fourth incident of its kind since mid-June.
On June 12, tampered scripts from Awesome Motive, the company behind OptinMonster, TrustPulse, and PushEngage, served malicious code that created attacker-controlled admin accounts and installed hidden webshell plugins. Those three products reach over 1.2 million sites. The window was short, roughly 25 minutes for two of the plugins, but the delivery mechanism was the vendor’s own CDN.
Days later, ShapedPlugin’s paid products, including Real Testimonials Pro and Product Slider Pro for WooCommerce, shipped with a backdoor injected into official releases through the vendor’s compromised build pipeline. The malware activated on admin pages, captured credentials and two-factor codes in plaintext, pulled database passwords out of wp-config.php, and exfiltrated three months of WooCommerce order data. It reached customers through the official licensed update channel.
On July 28, a backdoor appeared in version 10.8.7 of Advanced Responsive Video Embedder, a plugin on roughly 20,000 sites, after an apparent developer account compromise. The malicious file allowed full administrative access with no credentials. Wordfence’s scanning caught it within about two hours. That speed is the good news. It also shows how routine this detection work has become.
Then BdThemes in August. Four different vendors, four different entry points: a CDN, a build pipeline, a developer account, a cloud storage bucket. The common thread is that none of the victim sites did anything wrong.
Why updating everything didn’t help
The standard security advice for WordPress owners has been stable for a decade: keep core updated, keep plugins updated, use strong passwords, run a security plugin. It is good advice, and I give it to clients myself.
But look at what it does against these four incidents. ShapedPlugin customers were compromised because they installed official updates promptly. The advice worked as intended and delivered the payload. BdThemes users were compromised by plugins that were current, unmodified, and behaving normally. There was nothing to patch on the victim’s side because the victim’s software was never the problem.
The background numbers point the same way. Patchstack’s State of WordPress Security 2026 counted 11,334 new vulnerabilities across WordPress and its plugins and themes in 2025, up 42 percent in a year. Of those, 91 percent were in plugins. And 46 percent had no patch available on the day they were publicly disclosed. For nearly half of new flaws, “update everything” had nothing to offer on day one. I maintain a full incident tracker covering 2021 through 2026 with verified CVEs, official advisories, and what each one meant for site owners.
Update discipline handles the risks inside your fence. Supply chain attacks come in through the gate you deliberately built for the vendor.
Every plugin is a standing trust decision
I wrote earlier this year about what plugin overload does to speed and lead generation. This is the other half of that argument, and honestly the sharper half.
A plugin is a permanent, live relationship with a software company. You are trusting their code, and you are also trusting their build server, their cloud storage credentials, their marketing API, their developer laptops, and whoever they hire next year. When any of those fails, the failure arrives on your site under the vendor’s name, with full administrative privileges.
The average business WordPress site runs 20 to 30 plugins. That is 20 to 30 companies whose internal security you have adopted as your own, sight unseen. Most owners I talk to cannot name five of them. There is no realistic way to vet them, and after this summer I would argue even the well-run ones, and Awesome Motive is a large, professional operation, cannot fully vet themselves.
WordPress is a fine tool. We work on it, we maintain and build on it for clients, and plenty of fast, secure WordPress sites exist. But every plugin decision is a risk decision, and the industry default of solving each small problem with another vendor relationship has built what I think is the largest attack surface on the web.
The question that decides your exposure
Here is the question I wish more business owners asked: what is WordPress actually doing for you?
WordPress is a content management system. That is the product. It earns its complexity when you manage content: a team publishing weekly, multiple authors and editors, scheduling, categories, a real editorial workflow. If that describes your business, the risk can be worth carrying, managed properly.
The typical small business site I audit looks different. Eight to twelve pages. Content changes a few times a year, usually by one person, often by the agency. No editorial workflow, because there is no editorial team. And underneath it: a database, a public login page, a theme framework, a page builder, and two dozen plugins, each one a vendor relationship of exactly the kind that got poisoned this summer.
That site is paying the full cost of a content management system, in attack surface and maintenance, while using it as a brochure. The risk is real and the benefit is theoretical. If any of this sounds familiar, I have laid out an objective triage for deciding whether to optimize, harden, or leave WordPress, with thresholds you can score your own site against.
What to do this week
If you run any of the affected BdThemes plugins, or the others named above, check for compromise now. Look at your user list, including directly in the database, for admin accounts you did not create, especially usernames beginning with bd_. Check the mu-plugins folder for files you do not recognize, particularly anything matching class-wp-query-*.php. Wordfence’s advisory has the full indicator list. If you find anything, assume full compromise and get help, because this malware is built to hide from the dashboard.
Whether or not you were affected, do the exercise the incident actually calls for. List every active plugin on your site and the company behind it. Delete what you do not use, this week, since every removal permanently closes a door. For what remains, find out who is watching security advisories for your stack. If the answer is nobody, that is your maintenance gap, whoever is invoicing you for maintenance.
Then ask the structural question. Our own answer, for sites whose job is to win customers rather than run a newsroom, is to remove the category of risk instead of managing it. The Digital Foundations sites we build are static: prebuilt pages served as plain files, on an architecture I have compared directly with WordPress. There is no database to inject, no plugin phoning a vendor’s marketing server, no public login page, and no admin dashboard for a poisoned banner to hijack. A supply chain attack needs a supply chain, and a static brochure site barely has one.
This summer’s incidents were not caused by lazy site owners, and that is exactly the problem. When doing everything right no longer protects you, the winning move is owning less of what can be attacked.