Most WordPress security advice is pretty straightforward: keep the website, its theme and plugins up to date; use strong passwords; limit administrator access; and keep reliable backups.
Those measures are important. But a recent WordPress security incident is a reminder that sometimes the risk can originate beyond the website itself — through a trusted supplier.
This is known as a supply chain attack.
What is a supply chain attack?
A supply chain attack happens when an attacker compromises a product, service or external system that many people trust and use. Instead of trying to break into every individual website, they find a weakness further “upstream”.
In a WordPress context, that could mean compromising:
- a plugin or theme developer;
- a software update server;
- an external service used by a plugin;
- a shared library used by several plugins; or
- an account belonging to a supplier.
The website owner may have done nothing obviously wrong. Their site can be affected simply because it uses a legitimate plugin which has, in turn, been affected by a problem elsewhere.
A recent WordPress example
In August 2026, Wordfence reported an active supply chain compromise affecting several plugins from BdThemes, a WordPress development company, including plugins for Elementor, galleries, sliders and WooCommerce.
What made this incident particularly interesting was that attackers did not alter the plugin files held in the official WordPress plugin directory.
Instead, the affected plugins downloaded promotional-banner information from a remote service. Attackers appear to have gained access to that remote data source and inserted malicious code into its response. Because of an existing weakness in the plugins’ handling of that data, the malicious code could run when a logged-in WordPress administrator opened the dashboard.
In other words, a seemingly harmless promotional message in the admin area became a route into the site.
According to Wordfence, a successful attack could create a rogue administrator account, install malicious code or leave behind hidden access that would allow an attacker to return later.
Why this type of attack is difficult to spot
Traditional security scanning often looks for changed or suspicious files on the website’s server. In this case, the original plugin files could remain completely untouched.
The malicious content was delivered from elsewhere when an administrator viewed the dashboard. That means there may be no obvious altered plugin file for a routine integrity check to find.
It is also why keeping plugins updated, while essential, is not an absolute guarantee against every possible threat. In this incident, a site could potentially have been exposed without installing a new plugin update at all.
Does this mean WordPress plugins are unsafe?
No. WordPress plugins are an essential part of the platform, and reputable plugins are used safely on millions of websites.
However, plugins should be treated as third-party software with ongoing maintenance requirements, rather than as something installed once and forgotten.
Every additional plugin adds functionality, but also adds another supplier, another codebase and sometimes another connection to an external service. That does not mean “never use plugins”; it means choosing them carefully and keeping the site’s plugin list purposeful.
What should website owners do?
The sensible response is not panic. It is good website housekeeping:
- Keep WordPress core, themes and plugins updated, after appropriate checks.
- Remove plugins and themes that are no longer needed — inactive software can still create risk.
- Use plugins from established developers and avoid poorly maintained or abandoned products.
- Keep the number of plugins proportionate to the site’s real needs.
- Give administrator access only to people who genuinely require it.
- Use strong, unique passwords and two-factor authentication for administrator accounts.
- Maintain off-site backups, and periodically make sure they can actually be restored.
- Use security monitoring so that unexpected administrator accounts, file changes and suspicious activity can be investigated promptly.
For businesses, it is also worth having a clear record of which plugins are installed, what each one does and whether it is still needed.
If your site uses one of the affected BdThemes plugins
The affected plugins named by Wordfence include Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit Addons for Elementor, Ultimate Store Kit, Live Copy Paste for Elementor and Smart Admin Assistant.
If one of these is installed, removing or updating it may be sensible, but that alone may not be enough if the website was previously exposed. The site should also be checked for unfamiliar administrator accounts, unexpected plugins — particularly must-use plugins — suspicious files and unusual database entries.
This is a situation where a proper security review is more appropriate than simply clicking “update”.
For Dotwise customers
At Dotwise, we maintain a database of the plugins installed across our customers’ websites, updated at least monthly. When a security alert identifies a compromised plugin, we quickly check which sites may be affected. For each match, we assess the specific risk and take appropriate action — which may include updating, removing or deactivating the plugin, carrying out further checks, or documenting it as a known and managed risk in the client’s risk register.
The bigger lesson
The BdThemes incident is a reminder that website security is not just about protecting a password screen or applying the latest WordPress update. A modern website depends on a chain of trusted software and services.
Good maintenance reduces the risk, improves the chances of detecting a problem early and ensures that, if the worst happens, the site can be recovered cleanly and quickly.
That is why ongoing WordPress maintenance is not merely technical housekeeping. It is an important part of protecting a business’s website, reputation and online presence.