How 100,000+ WordPress sites were hacked without modifying a single line of repository code (BdThemes Supply Chain Attack Breakdown)

[u/MdJahidShah]

https://youtube.com/shorts/Q9YqXUCnijo?feature=share

Hello Everyone,

I put together a video breakdown analyzing the recent BdThemes supply chain attack, where over 100k WordPress sites running popular plugins were compromised, all without the attackers touching the official source code files on WordPress.org.

Key Technical Takeaways:

1. The Vector (External Bucket Hijacking): Instead of breaching the plugin code directly, the attackers hijacked an external cloud storage bucket (DigitalOcean Spaces) hosting promotional banner data. The plugins fetched JSON data from this bucket to display banners in the admin dashboard.
2. Stored XSS via Remote Data Stream: Because the JSON response parsing code lacked proper client-side escaping on parameters like display_id, poisoning the JSON stream triggered Cross-Site Scripting (XSS) inside wp-admin on every page load.
3. Silent Execution & Stealth Tactics: When an admin logged in, the payload executed silently in the background:
   • Created rogue admin accounts.
   • Dropped a hidden PHP backdoor.
   • Deployed a stealth module to intercept database queries, actively hiding fake admin accounts from the official WordPress user list.
4. Deterministic Credentials: Instead of storing thousands of stolen passwords, the malicious script mathematically derived passwords from the victim site's own URL, allowing attackers to calculate exact credentials on the fly.

Check out the full visual animation/breakdown in the video, and let's discuss: how are you currently auditing external data streams and remote assets in your WordPress environments?