BdThemes Supply Chain Attack Inserts Malicious JSON to Create Rogue WordPress Admin Accounts
What Happened – Researchers discovered that the WordPress.org repository was used to distribute a compromised version of a BdThemes plugin. The malicious update contained a hidden JSON payload that, when executed, creates unauthorized WordPress administrator accounts on any site that installs the plugin. WordPress.org temporarily disabled the plugin while the issue is investigated.
Why It Matters for Compliance & Audit Readiness
- This is a classic supply‑chain breach that tests the effectiveness of your vendor‑risk management controls (SOC 2 CC6.1 – Monitoring of third‑party service providers).
- Continuous evidence of vendor due‑diligence and real‑time monitoring of third‑party code changes are essential audit artifacts to demonstrate a defensible SOC 2 posture.
Who Is Affected – Web‑hosting firms, SaaS platforms, e‑commerce sites, and any organization that relies on WordPress plugins for public‑facing applications.
Recommended Actions –
- Immediately audit all WordPress installations for the compromised BdThemes version and remove it.
- Map the incident to SOC 2 CC6.1 vendor‑risk controls; capture evidence of vendor assessment, contract review, and ongoing monitoring.
- Implement a code‑integrity verification process (e.g., hash checks, signed plugins) and integrate it into your continuous‑compliance pipeline.
Source: The Hacker News
Technical Notes – The attack leveraged a supply‑chain vector; no CVE was issued because the WordPress.org repository itself was not vulnerable, but the plugin’s source was replaced with malicious code that injects a JSON payload to auto‑create admin users. Source: same article