BdThemes supply-chain attack enables unauthorized WordPress administrator accounts

A supply-chain compromise affecting WordPress plugin vendor BdThemes poisoned static JSON data fetched by the plugins for an administrative dashboard component. The attackers could create unauthorized administrator accounts, install a web shell, and establish concealed persistence.