Here’s a note from Copper Coin Web Design’s Developer Team:
Most WordPress security advice sounds pretty straightforward: keep your plugins updated, don’t click suspicious links, and use strong passwords.
But what happens when the problem comes from the company that made the plugin?
That is what happened in August 2026 with a supply chain attack involving several popular WordPress plugins. The attack was especially concerning because a website could be fully updated and still become compromised.
This incident is a good reminder for us at Copper Coin Design of why ongoing WordPress security matters. We manage a number of WordPress websites, so when an attack like this is discovered, we take the opportunity to review the sites in our portfolio and make sure everything is secure.
On August 7, 2026, Wordfence reported that attackers had compromised infrastructure belonging to BdThemes, a popular WordPress plugin vendor.
Seven plugins were affected:
Element Pack alone was running on more than 100,000 websites.
The vulnerability itself went back to March 1, 2026. It involved a cross site scripting issue that had been rated as medium severity.
The problem was not simply a vulnerable plugin sitting on someone’s website. The bigger issue was where the malicious code came from.
Normally, when a plugin has a security vulnerability, the solution is fairly simple. The developer releases an update, you install it, and the vulnerability is patched.
This attack was different.
The affected plugins included a promotional banner feature that pulled information from a remote API whenever an administrator loaded a WordPress admin page.
Attackers compromised BdThemes’ cloud storage and were able to replace legitimate content with malicious JavaScript.That code could then run in the browser of someone logged into WordPress as an administrator.
From there, the attackers could create hidden administrator accounts and install a disguised plugin that provided continued access to the website. That last part is important.
Even if the original plugin was updated, an attacker could still have access if a rogue administrator account or backdoor had already been installed.
So simply seeing that your plugins are all up to date does not necessarily mean your website is clean.
Once the attack was discovered, we didn’t want to assume that only the obviously affected websites needed attention.
We started going through the WordPress websites we manage and checking for signs of the affected plugins and any unusual activity.
That included:
Checking for the affected plugins.
We reviewed the sites in our Cloudways portfolio to see which websites had the affected plugins installed.
Reviewing administrator accounts.
We checked the user lists for accounts that shouldn’t be there. This is particularly important because an unauthorized account can be easy to overlook if you’re only looking for obvious changes to the website.
Looking for unfamiliar plugins.
We also checked for recently installed plugins that we couldn’t account for, since the attack could leave behind a disguised plugin.
Looking at ongoing monitoring.
We’re also evaluating tools such as WP Umbrella that can help us keep a closer eye on multiple WordPress websites from one place.
Keeping websites updated was still important. Sites that were already current were in a better position to receive Wordfence’s detection signatures when they became available. But this incident was a good reminder that updating is only one part of website security.
You don’t need to manage dozens of websites for this to matter.
Start by knowing what is actually installed on your WordPress site.
If you can’t name the plugins on your website, or you don’t know who developed them, that’s a good place to start. Old plugins and plugins that nobody is actively maintaining can create unnecessary risk.
Then take a look at your administrator accounts.
Do you recognize every person listed?
Does everyone still need access?
Are there accounts belonging to former employees, old developers, or people you simply don’t remember adding?
And remember, “everything is updated” doesn’t automatically mean “everything is safe.“
This attack is a good example of why.
The weakness wasn’t only in the website itself. The vendor’s infrastructure became part of the problem.
That’s why WordPress security needs to be more than logging in every few months and clicking “Update.”
Someone needs to be paying attention.
According to Wordfence, the infrastructure involved in this campaign was also connected to recent attacks involving Advanced Responsive Video Embedder, OptinMonster, and TrustPulse.
Those incidents happened in the two months leading up to this attack.
That’s worth paying attention to because it suggests this wasn’t simply one isolated event.
WordPress is popular with small businesses for good reason. It’s flexible, affordable, and there are thousands of plugins that can add almost anything you need to a website.
But that large plugin ecosystem also creates opportunities for attackers.
For business owners, that means website security needs to be an ongoing process, not something you think about only after something goes wrong.
If you’re not sure which plugins are installed on your WordPress website, don’t know who has administrator access, or simply want another set of eyes on things, we’re happy to help.
At Copper Coin Design, we manage WordPress websites and hosting for businesses throughout Northeast Florida. We can take a look at your plugins, users, and overall setup and help you figure out where you may have vulnerabilities.
If this attack has you wondering what’s happening behind the scenes on your website, let’s take a look.
Encountering an issue or have a question about your site? Submit a maintenance request below, and Copper Coin Design will address your concern promptly and efficiently!
Looking to create a new website or refresh your existing one? Copper Coin Design is here to help.
