BdThemes supply chain attack poisons JSON feed to create rogue WordPress admins and deploy web shells without code changes.
BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.
The data was scraped and exfiltrated from 2,500 users of a compromised AI package.