A novel supply chain compromise targeting the WordPress ecosystem has been uncovered, with threat actors bypassing traditional code review mechanisms by injecting malicious payloads into non-executable JSON configuration files. The campaign, which impacts plugins developed by vendor BdThemes, has also been linked to the exploitation of cross-site scripting (XSS) vulnerabilities in seven plugins to deploy a PHP web shell for persistence. The incident has prompted the official WordPress plugins team to temporarily suspend downloads while security investigations proceed.
Wordfence researcher Paolo Tresso identified the incident as a significant tactical shift in open-source attacks. Unlike conventional supply chain breaches that tamper directly with PHP scripts or binaries, this operation manipulated trusted JSON data files. Tresso confirmed that zero source code files were altered within the official repository, allowing the malicious content to slip past automated scanners and manual audits that typically focus on executable logic.
Once deployed on a target site, the poisoned configuration files silently generated unauthorized administrator accounts. This payload grants attackers persistent, full-level backend access without triggering standard integrity alerts. The attack chain also involved leveraging XSS flaws to install a PHP web shell, providing a backdoor for further operations. This technique exploits a foundational assumption in modern web development: that auxiliary data files are inherently benign. By weaponizing JSON—a format widely used for plugin settings, localization, and metadata—the perpetrators demonstrated that even rigorously vetted distribution channels can be subverted without touching core application code.
The WordPress plugins team acted swiftly to disable the affected BdThemes packages, mitigating further exposure. However, the campaign underscores a growing operational challenge for platform maintainers and enterprise security teams. As open-source ecosystems mature, the attack surface has expanded beyond traditional codebases into configuration layers, build pipelines, and dependency trees. Traditional static analysis and hash-based verification tools are increasingly blind to threats residing outside executable boundaries.
For IT professionals and open-source maintainers, this development signals an urgent need to evolve security postures. Relying exclusively on source code analysis is no longer sufficient. Organizations must implement layered monitoring that tracks anomalous account creation, unexpected privilege escalations, and irregularities in non-executable asset delivery. Security teams should also consider extending static and dynamic analysis to cover configuration files and build artifacts, treating them with the same scrutiny as executable code. Behavioral detection and continuous audit logging have become essential complements to traditional vulnerability scanning.
While the full technical breakdown of how the attackers initially breached BdThemes’ update pipeline remains under investigation, the campaign serves as a stark reminder that trust in centralized repositories must be continuously validated. As the WordPress platform continues to power a significant portion of the global web, defenders will need to adapt their detection strategies to account for increasingly sophisticated, non-traditional supply chain vectors. The incident reinforces that comprehensive web application security now requires visibility across both code and configuration.
針對 WordPress 生態系統的新型供應鏈攻擊已被揭露，威脅行為者透過在不可執行的 JSON 配置檔案中注入惡意載荷，繞過了傳統代碼審查機制。這場波及供應商 BdThemes 開發插件的攻擊行動，亦涉及利用七個插件中的跨站腳本攻擊（XSS）漏洞，以部署 PHP web shell 實現持久化控制。事件促使 WordPress 官方插件團隊在安全調查期間暫時暫停下載服務。
Wordfence 研究員 Paolo Tresso 將此事件識別為開源攻擊的重大戰術轉變。與直接篡改 PHP 腳本或二進位檔案的傳統供應鏈入侵不同，此操作操控了受信任的 JSON 資料檔案。Tresso 確認官方儲存庫中沒有任何原始碼檔案被修改，使惡意內容得以避開通常聚焦於可執行邏輯的自動掃描器和人工審計。
一旦部署到目標網站，被投毒的配置檔案會靜靜生成未經授權的管理員賬戶。該載荷賦予攻擊者持久性的完整後端存取權限，同時不會觸發標準完整性警報。攻擊鏈亦涉及利用 XSS 缺陷安裝 PHP web shell，為後續操作提供後門。此技術利用了現代 Web 開發的一個基本假設：輔助資料檔案本質上是無害的。透過武器化 JSON——這種廣泛用於插件設定、本地化和元資料的格式——攻擊者證明了即使經過嚴格審核的發行管道，也可能在不觸及核心應用程式代碼的情況下被滲透。
WordPress 插件團隊迅速採取行動，停用受影響的 BdThemes 套件，以降低進一步風險。然而，此攻擊行動凸顯了平台維護者和企業安全團隊日益嚴峻的營運挑戰。隨著開源生態系統日漸成熟，攻擊面已從傳統代碼庫擴展至配置層、建置管線和依賴樹。傳統靜態分析和基於哈希的驗證工具，越來越難以偵測存在於可執行邊界之外的威脅。
對 IT 專業人員和開源維護者而言，此發展表明需迫切更新安全防護策略。僅依賴原始碼分析已不再足夠。組織必須實施分層監控，追蹤異常帳戶建立、非預期的權限提升，以及非可執行資產交付的異常情況。安全團隊亦應考慮將靜態和動態分析擴展至配置檔案和建置產物，並以與可執行代碼相同的嚴格標準進行審查。行為偵測和持續審計日誌已成為傳統漏洞掃描的重要補充。
雖然攻擊者最初如何入侵 BdThemes 更新管線的完整技術細節仍在調查中，但此攻擊行動強烈提醒我們：對集中式儲存庫的信任必須持續驗證。隨著 WordPress 平台繼續支撐全球相當比例的網站，防禦者將需調整其偵測策略，以應對日益複雜、非傳統的供應鏈攻擊向量。此事件強化了一個觀點：現今全面的 Web 應用程式安全要求對代碼和配置均有清晰的可視性。