WordPress supply chain attack compromises plugins without changing code files

Infosecurity Magazine reports that a supply chain attack targeting WordPress plugin vendor BdThemes allowed attackers to create rogue administrator accounts on sites using affected plugins, without modifying any source code files in the official WordPress.org repository. Wordfence researchers explained that the attack worked by poisoning a JSON feed used by the plugins to retrieve updates and configuration data. This allowed attackers to inject malicious instructions that created backdoor admin accounts, bypassing traditional file integrity checks that would normally detect tampered plugin code. WordPress temporarily disabled downloads of BdThemes plugins while the issue was addressed.

Why this matters for UK organisations

This attack demonstrates how supply chain compromises are evolving beyond direct code tampering. Many organisations rely on file integrity monitoring, code signing, and repository audits to detect malicious changes to software they use. However, if an attacker can compromise the update mechanism, configuration feeds, or API endpoints that software relies on, they can achieve the same outcome without touching the code itself. For organisations running WordPress sites, particularly those used for customer-facing services, e-commerce, or internal portals, this type of attack can create a significant and difficult-to-detect risk. A rogue administrator account can be used to exfiltrate data, modify content, inject malicious scripts, or pivot into other systems. The fact that the attack bypassed code-level checks means that traditional security controls may not have detected the compromise until unusual admin activity was noticed. This highlights the importance of monitoring not just what software is installed, but how that software communicates with external services, what permissions it requests, and what changes it makes to user accounts and site configuration.

What to review

Organisations using WordPress or other content management systems should review whether plugins and themes are kept up to date, whether there is a process for reviewing and limiting the number of third-party plugins in use, and whether admin account creation and privilege changes are monitored and alerted on. Consider implementing web application firewalls, admin access logging, and anomaly detection to catch unexpected changes to user permissions or site configuration. Review whether WordPress sites are running with appropriate security hardening, including two-factor authentication for admin accounts, regular security audits, and separation of development, staging, and production environments. For organisations managing multiple WordPress sites, consider whether there is centralised visibility into plugin usage, update status, and admin activity across the estate. This incident is also a reminder that supply chain risk extends to the update and configuration mechanisms that software relies on, not just the code itself.

Source: Infosecurity Magazine