decrypted · 11 august 2026 · vulnerabilities and patching · supply chain · ai and llm security

The WordPress plugin update banner that could log in as you

Wordfence disclosed on Monday that attackers spent the summer inside a small WordPress plugin vendor's infrastructure, not rewriting any code but quietly poisoning a JSON file that a marketing banner in the plugin's admin screen polls on every page load. That file told the browsers of logged-in administrators, across some 350,000 sites running BdThemes' plugin portfolio, including Element Pack's 100,000-plus installs and several sibling plugins, to create a hidden new admin account and drop a web shell. WordPress.org pulled the plugins on 8 August, the underlying flaw is still unpatched, and the infrastructure behind the campaign has been linked to earlier compromises of the Advanced Responsive Video Embedder and OptinMonster plugins this year. WordPress still runs a large share of the world's websites, including plenty of UK charity, school and small business sites built on exactly this kind of premium plugin stack, so this is a supply chain risk worth taking seriously even if nobody in IT has ever heard of BdThemes.

A banner, not a build pipeline

The mechanism is worth understanding because it breaks the usual mental model of a supply chain attack. Picture a noticeboard in a shop's staff-only back office, meant only to display supplier adverts, that turns out to be wired directly into the till: a card pinned to that board can make the till open. BdThemes' plugins included a small promotional banner component that fetched a JSON file from the vendor's cloud storage purely to display upsell adverts inside the WordPress dashboard. A scripting flaw in how that JSON was parsed meant attacker-controlled content in the file could run as JavaScript inside the browser of whoever was logged in, which in this context is always an administrator. No plugin file on disk changed, so nothing WordPress.org's review process would have caught, because the code doing the damage was never submitted for review. It lived in a data file on a storage bucket, fetched fresh every time an admin opened their dashboard. Wordfence traced the flaw to a code change from March 2026 and the earliest confirmed exploitation to 23 June.

The lesson: what you fetch is what you trust

The design failure sits at a boundary the vendor never drew. Content served to sell add-ons and code allowed to run with administrator privilege ended up in the same pipe, with no separation between the two. Secure by Design would treat any remote content pulled into an authenticated admin session as hostile by default: escaped on output, and structurally incapable of executing script no matter what the JSON contains or how trusted the source appears. UK organisations running WordPress, particularly the charities, agencies and small businesses that stack several premium plugins together, should not assume WordPress.org's plugin review vets everything a plugin does after installation. It vets the code you download, not the services that code quietly calls afterwards. The practical response this week: check for unfamiliar admin accounts and unrecognised plugin files, disable the affected BdThemes plugins until a real patch ships, and treat any "check for updates" or promotional component as its own piece of attack surface rather than a footnote.

Also this week

Poland's national CERT disclosed on 8 August that attackers shut down a steam turbine and a process-water treatment system at a combined heat and power plant serving around 50,000 residents, in what it believes is the first recorded attack to reach an industrial network through a private mobile network. The route in ran through a wind farm's firewall with no multi-factor authentication, then a router, into an access point network that let any connected client talk to any other, straight into Siemens PLCs and a WAGO controller still on its default password. The specifics are Polish, but private mobile networks are exactly the kind of "it's not really the internet, so it's fine" access route UK utilities and NHS trusts are increasingly using for remote OT management, and this is a clean demonstration of why that assumption needs testing rather than trusting.

Security researchers who built a fake cryptocurrency startup and hired three job applicants through normal recruitment channels found all three were, per a DEF CON 34 presentation this month, suspected North Korean IT workers using AI-edited identity documents, AI job-application tools and a shared two-factor-code relay service to get through interviews undetected. The presentation landed days after the UK joined ten other governments, including the US, Japan and South Korea, in a joint alert warning that North Korean IT workers are actively targeting employers with false identities, UK ones included. For any UK organisation hiring remote contractors, it's a reminder that a video call and a reference check are no longer sufficient proof of who is actually on the other end.

Sources

If your organisation runs WordPress or manages OT over a private network and wants a second opinion on where the trust boundaries actually sit, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.