WordPress Plugins Compromised Without a Single File Change

Attackers poisoned bdThemes' JSON API feed to backdoor WordPress sites by serving malicious remote code without modifying plugin files.

Infosecurity Magazine reports a supply chain attack in which attackers poisoned a JSON feed used by bdThemes WordPress plugins. The compromised feed delivered malicious code that backdoored sites without changing any plugin files, evading file-integrity based detection. WordPress sites running the vendor's plugins were affected.

• Supply chain attack via poisoned JSON API feed from bdThemes
• Backdoor deployed with zero plugin file changes on victim sites
• File-integrity monitoring would not detect the compromise
• WordPress sites using bdThemes plugins are affected