BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.
BdThemes supply chain attack poisons JSON feed to create rogue WordPress admins and deploy web shells without code changes.