BdThemes API-Driven Supply Chain Compromise: Admin XSS to Web Shell and Hidden Admin ...
BdThemes API-Driven Supply Chain Compromise: Admin XSS to Web Shell and Hidden Admin
1. Basic Information
Article Title: PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
Publisher: Wordfence Threat Intelligence
Publication Date: August 8, 2026
BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell…
A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and…
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core…
Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import...
Attackers are exploiting two WordPress flaws as wp2shell, chaining them for unauthenticated RCE and deploying web shells and…
Attackers stole a limited amount of internal credential material after malware hidden in poisoned packages reached two staff…
