{"id":238,"date":"2026-08-09T10:46:13","date_gmt":"2026-08-09T08:46:13","guid":{"rendered":"https:\/\/helloblog.io\/lt\/bdthemes-api-tiekimo-grandines-ataka\/"},"modified":"2026-08-09T10:46:13","modified_gmt":"2026-08-09T08:46:13","slug":"bdthemes-api-tiekimo-grandines-ataka","status":"publish","type":"post","link":"https:\/\/helloblog.io\/lt\/bdthemes-api-tiekimo-grandines-ataka\/","title":{"rendered":"BdThemes \u012fskiepi\u0173 tiekimo grandin\u0117s ataka per u\u017enuodyt\u0105 API: k\u0105 patikrinti WordPress svetain\u0117je"},"content":{"rendered":"\n<p>BdThemes \u012fskiepi\u0173 ekosistem\u0105 paveik\u0117 tiekimo grandin\u0117s kompromitavimas, kuriam u\u017epuolikams nereik\u0117jo pakeisti n\u0117 vieno failo oficialioje WordPress.org saugykloje. Jie pakeit\u0117 nuotolinio API gr\u0105\u017einamus JSON \u012fra\u0161us ir per administratoriaus nar\u0161ykl\u0119 \u012fvykd\u0117 XSS kod\u0105, tod\u0117l svetain\u0117 gal\u0117jo b\u016bti perimta vien atidarius bet kur\u012f <code>wp-admin<\/code> puslap\u012f.<\/p>\n\n\n\n<p>Paveikti \u012fskiepiai laikinai u\u017edaryti WordPress \u012fskiepi\u0173 kataloge, kol WordPress Plugins komanda atlieka patikr\u0105 ir t\u0119siamas tyrimas. Jei naudojate bent vien\u0105 i\u0161 j\u0173, nelaukite \u012fskiepio atnaujinimo: patikrinkite savo naudotojus, \u012fskiepi\u0173 katalogus ir duomen\u0173 baz\u0119 pagal \u0161iame straipsnyje pateiktus kompromitavimo po\u017eymius.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Kod\u0117l \u0161is incidentas i\u0161skirtinis<\/h4>\n\n\n<p>U\u017ekr\u0117sti galima ir be \u012fskiepio atnaujinimo. Ataka vyko per nuotolin\u012f reklamin\u012f JSON sraut\u0105, tod\u0117l \u012fprastas fail\u0173 integralumo tikrinimas pakeist\u0173 \u012fskiepio fail\u0173 neras, o WAF j\u0105 gali pasteb\u0117ti sunkiai.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Kaip veik\u0117 kompromitavimas<\/h2>\n\n\n\n<p>BdThemes \u012fskiepiuose yra vidinis komponentas <em>Biggopti<\/em>. Jis \u012f WordPress administravimo skydel\u012f \u012fkelia reklaminius prane\u0161imus: JavaScript pasiima duomenis i\u0161 tiek\u0117jo API, o paskui nar\u0161ykl\u0117je suformuoja HTML. API duomenis aptarnavo ne dinaminis program\u0173 serveris, bet statiniai JSON failai DigitalOcean Spaces objekt\u0173 saugykloje, kuri\u0105 saugojo Cloudflare.<\/p>\n\n\n\n<p>Problema kilo d\u0117l nepakankamo <code>display_id<\/code> reik\u0161m\u0117s i\u0161valymo prie\u0161 \u012fterpiant j\u0105 \u012f HTML <code>id<\/code> atribut\u0105. U\u017epuolikai \u012fgijo ra\u0161ymo prieig\u0105 prie saugyklos, pakeit\u0117 teis\u0117tus JSON atsakymus specialiai suformuotais \u012fra\u0161ais ir taip i\u0161naudojo jau \u012fskiepiuose buvus\u012f XSS pa\u017eeid\u017eiamum\u0105.<\/p>\n\n\n\n<p>Kiekvienas Biggopti naudojantis \u012fskiepis per <code>admin_init<\/code> prijungia kliento JavaScript. Vadinasi, kodas vykdomas bes\u0105lygi\u0161kai kiekvien\u0105 kart\u0105, kai prisijung\u0119s administratorius atidaro bet kur\u012f <code>wp-admin<\/code> puslap\u012f. Pa\u017eeid\u017eiama logika i\u0161 nuotolinio \u012fra\u0161o ima <code>display_id<\/code> arba <code>id<\/code> ir tiesiogiai sudeda reik\u0161m\u0119 \u012f atributo eilut\u0119.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Nuotolin\u0117 reik\u0161m\u0117 nebuvo i\u0161valoma prie\u0161 patekdama \u012f HTML atribut\u0105.\nvar displayId = item.display_id || item.id || &quot;default&quot;;\nvar elementId = &quot;bdt-admin-biggopti-api-biggopti-&quot; + displayId;\nhtml = 'id=&quot;' + elementId + '&quot;';\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Nuotolin\u0117 reik\u0161m\u0117 nebuvo i\u0161valoma prie\u0161 patekdama \u012f HTML atribut\u0105.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> displayId <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> item.display_id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#E1E4E8\"> item.id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"default\"<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> elementId <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> \"bdt-admin-biggopti-api-biggopti-\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> displayId;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">html <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> 'id=\"'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> elementId <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> '\"'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Tame pa\u010diame kode <code>data-display-id<\/code> atributui buvo naudojamas simboli\u0173 i\u0161valymas: <code>&amp;<\/code>, <code>&lt;<\/code>, <code>&gt;<\/code>, ir kabut\u0117s pakei\u010diami HTML esyb\u0117mis. Nors \u0161i dalis d\u0117l minifikavimo arba bundling atrodo painiai, ji parodo, kad b\u016btent <code>id<\/code> atributo vieta liko neapsaugota.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function escapeAttribute(value) {\n  return (value || &quot;&quot;)\n    .replace(\/&amp;\/g, &quot;&amp;amp;&quot;)\n    .replace(\/&lt;\/g, &quot;&amp;lt;&quot;)\n    .replace(\/&gt;\/g, &quot;&amp;gt;&quot;)\n    .replace(\/&quot;\/g, &quot;&amp;quot;&quot;);\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> escapeAttribute<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#FFAB70\">value<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> (value <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x26;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;amp;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x3C;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;lt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">><\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;gt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">\"<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;quot;\"<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Nei\u0161valyt\u0105 atributo \u012fterpim\u0105 Prime Slider \u012fskiepyje \u012fdieg\u0117 2026 m. kovo 1 d. versija 4.1.9, SVN pakeitime <code>r3471891<\/code>, o v\u0117liau tokia logika pateko ir \u012f kitus \u012fskiepius. V\u0117lesn\u0117se laidose turinio laukui prid\u0117tas <code>DOMParser<\/code> valiklis, kuris \u0161alina pavojingas HTML \u017eymas bei inline handlerius, ta\u010diau <code>id<\/code> atributas ir toliau nebuvo i\u0161valomas.<\/p>\n\n\n\n<p>Kenk\u0117ji\u0161kas <code>display_id<\/code> i\u0161tr\u016bkdavo i\u0161 <code>id<\/code> atributo ir prid\u0117davo <code>onanimationstart<\/code> \u012fvykio handler\u012f. CSS animacija j\u012f suaktyvindavo ma\u017edaug per 10 milisekund\u017ei\u0173, tod\u0117l kodas tyliai pasileisdavo administratoriui \u012fk\u0117lus administravimo puslap\u012f. Tuo metu u\u017ekr\u0117stame API atsakyme dar buvo \u201eSummer Sale\u201c prane\u0161imo \u012fra\u0161as su tokiu payload.<\/p>\n\n\n\n<p>Pa\u017eeid\u017eiamumas \u012fvertintas <strong>5.4 CVSS (vidutinis)<\/strong> balais ir netur\u0117jo pataisos. I\u0161samus pa\u017eeid\u017eiamumo \u012fra\u0161as: <a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/7bf1d6f9-afe2-41c2-968b-20dbc474cd73\">Biggopti Library \u2013 Cross-Site Scripting via display_id from Sigmative API<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Du kenk\u0117ji\u0161k\u0173 payload etap\u0173 keliai<\/h2>\n\n\n\n<p>XSS \u012fvykio handleris \u012fkeldavo i\u0161orin\u012f scenarij\u0173 pagal u\u017epuolik\u0173 infrastrukt\u016bros pasiekiamum\u0105. Pagrindinis kelias naudojo <code>api-data-all-records<\/code> endpoint, o alternatyvus \u2013 <code>api-data-records<\/code> endpoint.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pagrindinis payload: <code>w2.js<\/code><\/h3>\n\n\n\n<p><code>w2.js<\/code>, vykdomas aktyvioje administratoriaus sesijoje, veik\u0117 tokia seka:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Patikrindavo C2 server\u012f.<\/strong> \u012e <code>ia-cdn[.]com\/fz\/c<\/code> i\u0161si\u0173sdavo svetain\u0117s origin ir gaudavo taikymo instrukcijas. Jei C2 atsakydavo <code>skip<\/code> arba <code>done<\/code>, scenarijus nutraukdavo darb\u0105.<\/li>\n\n\n<li><strong>Sukurdavo neteis\u0117t\u0105 administratoriaus paskyr\u0105.<\/strong> Scenarijus panaudodavo aktyvioje sesijoje esant\u012f <code>X-WP-Nonce<\/code> ir WordPress REST API. Jei tai nepavykdavo, naudodavo \u012fprast\u0105 formos pateikim\u0105.<\/li>\n\n\n<li><strong>\u012ediegdavo webshell.<\/strong> I\u0161 C2 serverio parsisi\u0173sdavo netikr\u0105 \u012fskiepio ZIP ir \u012fkeldavo j\u012f per standartin\u0119 \u012fskiepi\u0173 \u012fk\u0117limo form\u0105. \u012eskiepis maskuodavosi <code>wp-smart-thumbnails<\/code> arba pana\u0161iu neutraliu slug, o jame esantis <code>emer-run.php<\/code> webshell b\u016bdavo kvie\u010diamas tiesiogiai URL adresu.<\/li>\n\n\n<li><strong>\u012era\u0161ydavo Must-Use (MU) \u012fskiepi\u0173 u\u017epakalines duris.<\/strong> Paleidus <code>emer-run.php<\/code>, \u012f MU \u012fskiepi\u0173 katalog\u0105 patekdavo du i\u0161likim\u0105 u\u017etikrinantys moduliai. Abu i\u0161tirti pavyzd\u017eiai buvo dirbtinai datuoti 2025 m. rugs\u0117ju, kad susiliet\u0173 su teis\u0117tais fail\u0173 laiko \u017eymenimis; fail\u0173 vardai skirtinguose u\u017ekr\u0117timuose gali skirtis. Pirmasis modulis leido neprisijungus patekti administratoriaus teis\u0117mis per URL parametr\u0105 <code>?_wplogin=&lt;token&gt;<\/code> ir taik\u0117si \u012f seniausiai svetain\u0117je registruot\u0105 administratori\u0173. Antrasis modulis sl\u0117pdavo neteis\u0117tas paskyras: jis hook perimdavo WordPress duomen\u0173 baz\u0117s u\u017eklausas, pa\u0161alindavo sukurtas paskyras i\u0161 administravimo naudotoj\u0173 s\u0105ra\u0161o ir atitinkamai ma\u017eindavo bendr\u0105 naudotoj\u0173 skai\u010di\u0173.<\/li>\n\n\n<li><strong>I\u0161si\u0173sdavo rezultatus.<\/strong> Kiekvieno vykdymo etapo duomenis persi\u0173sdavo C2 serveriui per <code>navigator.sendBeacon<\/code>.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatyvus payload: <code>x.js<\/code><\/h3>\n\n\n\n<p>Antrinis scenarijus <code>x.js<\/code> buvo laikomas tiesiogiai BdThemes infrastrukt\u016broje ir pasiekdavo aukas per <code>api-data-records<\/code>. Jis i\u0161 svetain\u0117s hostname matemati\u0161kai apskai\u010diuodavo deterministinius administratoriaus prisijungimo duomenis: naudotojo vard\u0105 <code>bd_<\/code> su \u0161e\u0161i\u0173 simboli\u0173 base36 hash, slapta\u017eod\u012f <code>Bd@26!<\/code> su tuo pa\u010diu hash ir galine <code>x<\/code>, taip pat el. pa\u0161to adres\u0105 su <code>@wordpress.org<\/code> domenu.<\/p>\n\n\n\n<p>Kadangi duomenys priklauso tik nuo hostname, u\u017epuolikams nereikia centralizuotai saugoti u\u017ekr\u0117st\u0173 svetaini\u0173 s\u0105ra\u0161o. Incident\u0105 tiriantys specialistai gali i\u0161 \u012ftariamos svetain\u0117s domeno apskai\u010diuoti tiksl\u0173 naudotojo vard\u0105 ir slapta\u017eod\u012f, kurio turi ie\u0161koti.<\/p>\n\n\n\n<p>Scenarijus atidarydavo <code>\/wp-admin\/user-new.php<\/code>, i\u0161 puslapio i\u0161traukdavo nonce ir atsijungimo URL, o paskui per formos POST sukurdavo administratori\u0173. \u012e C2 jis persi\u0173sdavo k\u016brimo b\u016bsen\u0105, prisijungimo duomenis, svetain\u0117s origin, atsijungimo URL ir puslapio URL; tam pirmiausia bandydavo <code>navigator.sendBeacon<\/code>, o nepavykus \u2013 <code>fetch<\/code> u\u017eklaus\u0105 be CORS atsakymo skaitymo. Nar\u0161ykl\u0117s <code>localStorage<\/code>, jei jis buvo prieinamas, \u012fra\u0161ydavo vykdymo v\u0117liav\u0105, kad scenarijus nebekartot\u0173 operacijos.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0105 apima incidentas<\/h2>\n\n\n\n<p>C2 domenas siejamas su tais pa\u010diais veik\u0117jais, kurie per pastaruosius du m\u0117nesius \u012fvykd\u0117 <a href=\"https:\/\/www.wordfence.com\/blog\/2026\/07\/wordfence-prism-detected-backdoored-wordpress-plugin-within-two-hours-of-it-being-introduced\/\">Advanced Responsive Video Embedder<\/a> ir <a href=\"https:\/\/optinmonster.com\/security-incident-tampered-script-served-via-optinmonster-and-trustpulse\/#what-to-check-and-do\">OptinMonster<\/a> tiekimo grandin\u0117s atakas.<\/p>\n\n\n\n<p>Kampanija siek\u0117 pla\u010diai ir nepastebimai \u012fsitvirtinti administratoriaus teis\u0117mis bei \u012fgyti nuotolinio kodo vykdymo galimyb\u0119 WordPress aplinkose. U\u017epuolikams nereik\u0117jo nei prieigos prie konkre\u010di\u0173 svetaini\u0173, nei pakeisti \u012fskiepi\u0173 \u0161altinio: pakako u\u017enuodyti patikimu laikyt\u0105 reklamin\u012f sraut\u0105. Kenk\u0117ji\u0161ki JSON \u012fra\u0161ai ir <code>x.js<\/code> atsirado pa\u010dio tiek\u0117jo saugykloje, tod\u0117l tai rodo rimt\u0105 BdThemes debesijos prieigos duomen\u0173 arba vidin\u0117s infrastrukt\u016bros kompromitavim\u0105.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Paveikti \u012fskiepiai<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/bdthemes-element-pack-lite\">Element Pack Addons for Elementor<\/a> \u2013 <code>bdthemes-element-pack-lite<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/bdthemes-prime-slider-lite\">Prime Slider Addons for Elementor<\/a> \u2013 <code>bdthemes-prime-slider-lite<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/pixel-gallery\">Pixel Gallery Addons for Elementor<\/a> \u2013 <code>pixel-gallery<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/ultimate-post-kit\">Ultimate Post Kit Addons for Elementor<\/a> \u2013 <code>ultimate-post-kit<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/ultimate-store-kit\">Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor<\/a> \u2013 <code>ultimate-store-kit<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/live-copy-paste\">Live Copy Paste for Elementor<\/a> \u2013 <code>live-copy-paste<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/smart-admin-assistant\">Smart Admin Assistant<\/a> \u2013 <code>smart-admin-assistant<\/code><\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Kompromitavimo po\u017eymiai ir patikra<\/h2>\n\n\n\n<p>Prad\u0117kite nuo naudotoj\u0173 s\u0105ra\u0161o, nes u\u017epakalin\u0117s durys gali sl\u0117pti sukurtas paskyras administravimo s\u0105sajoje. Ie\u0161kokite administratori\u0173, kuri\u0173 el. pa\u0161to domenas yra <code>@wordpress.org<\/code> arba <code>@developer.wordpress.org<\/code>, ir naudotoj\u0173 vard\u0173, atitinkan\u010di\u0173 <code>bd_<\/code> bei \u0161e\u0161i\u0173 raidini\u0173 skaitmenini\u0173 simboli\u0173 \u0161ablon\u0105.<\/p>\n\n\n\n<p>Tada patikrinkite \u012fskiepi\u0173 ir ypa\u010d MU \u012fskiepi\u0173 katalog\u0105. Svarb\u016bs failai bei j\u0173 MD5 reik\u0161m\u0117s:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Webshell: <code>emer-run.php<\/code> \u2013 MD5 <code>1024732009983dd5e54b4cf5593f04d4<\/code>.<\/li>\n\n\n<li>Magic-login MU u\u017epakalin\u0117s durys: <code>class-wp-token-validate.php<\/code> \u2013 MD5 <code>7719cd98a35ffad2771f26d1ceab7d27<\/code>.<\/li>\n\n\n<li>Slaptumo MU modulis: <code>class-wp-query-9d127ff3.php<\/code> arba pana\u0161us <code>class-wp-query-*.php<\/code> pavadinimas \u2013 MD5 <code>9aadc3e5c5242b273bd17c5bdc358845<\/code>.<\/li>\n\n\n<li>MU \u201eHealth Check\u201c modulis: <code>wp-cache-optimizer.php<\/code> \u2013 MD5 <code>e450ae5bc4bfc0d960dded06a76bb8e9<\/code>.<\/li>\n\n<\/ul>\n\n\n\n<p>Duomen\u0173 baz\u0117je ie\u0161kokite parink\u010di\u0173 <code>fz_emer_login_tokens<\/code>, kur saugomi magic-login tokenai, ir <code>fz_emer_done_v1<\/code>, kuri \u017eymi baigt\u0105 kompromitavim\u0105. Taip pat per\u017ei\u016br\u0117kite \u017eurnalus ir tinklo sraut\u0105 d\u0117l toliau nurodyt\u0173 i\u0161orini\u0173 resurs\u0173.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Pagrindinis payload: <code>ia-cdn[.]com\/fz\/w2.js<\/code>.<\/li>\n\n\n<li>C2 beacon endpoint: <code>ia-cdn[.]com\/fz\/c<\/code>.<\/li>\n\n\n<li>Anks\u010diau u\u017enuodyti, dabar i\u0161valyti tiek\u0117jo endpoint: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-all-records<\/code>, <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-records<\/code> ir <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/x.js<\/code>.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Tikrinkite kelis sluoksnius<\/h4>\n\n\n<p>Neribokite patikros vien \u012fskiepi\u0173 fail\u0173 palyginimu su oficialia versija. \u0160i ataka gal\u0117jo palikti nepakitusius BdThemes \u012fskiepio failus, bet \u012fra\u0161yti administratoriaus paskyras, atskir\u0105 netikr\u0105 \u012fskiep\u012f, MU modulius ir duomen\u0173 baz\u0117s parinktis.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">\u012evyki\u0173 eiga<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>2026-03-01:<\/strong> Prime Slider 4.1.9 \u012fdieg\u0117 Biggopti API JavaScript (<code>r3471891<\/code>). <code>display_id<\/code> pateko \u012f <code>id<\/code> atribut\u0105 nei\u0161valytas; naudotas <code>api-data-records<\/code> endpoint.<\/li>\n\n\n<li><strong>2026-05-10:<\/strong> Endpoint pakeistas \u012f <code>api-data-all-records<\/code>. Turinio laukui prid\u0117tas <code>DOMParser<\/code> valiklis, bet <code>id<\/code> atributas liko pa\u017eeid\u017eiamas.<\/li>\n\n\n<li><strong>2026-06-23:<\/strong> U\u017enuodytame API sraute nurodyta kampanijos <code>start_date<\/code> su \u201eSummer Sale\u201c prane\u0161imu. Tai ankstyviausia galima XSS aktyvumo data.<\/li>\n\n\n<li><strong>2026-08-06 22:40 UTC:<\/strong> U\u017enuodyto <code>api-data-records<\/code> paskutinis pakeitimo laikas.<\/li>\n\n\n<li><strong>2026-08-07 09:11 UTC:<\/strong> U\u017enuodyto <code>api-data-all-records<\/code> paskutinis pakeitimo laikas.<\/li>\n\n\n<li><strong>2026-08-07:<\/strong> U\u017efiksuota ataka realiose svetain\u0117se, o paveikti \u012fskiepiai u\u017edaryti WordPress kataloge, kol vyksta per\u017ei\u016bra.<\/li>\n\n\n<li><strong>2026-08-07 16:56 UTC:<\/strong> U\u017efiksuoti tyrimo artefaktai.<\/li>\n\n\n<li><strong>2026-08-08:<\/strong> Abu API endpoint jau gr\u0105\u017eino \u0161var\u0173 JSON.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0105 daryti dabar<\/h2>\n\n\n\n<p>Jei naudojate paveikt\u0105 BdThemes \u012fskiep\u012f, nedelsdami atlikite kompromitavimo po\u017eymi\u0173 audit\u0105: per\u017ei\u016br\u0117kite naudotoj\u0173 lentel\u0119 ir administratori\u0173 paskyras, paie\u0161kokite netikro \u012fskiepio bei MU moduli\u0173, patikrinkite <code>wp_options<\/code> parinktis ir i\u0161analizuokite ry\u0161ius su nurodytais domenais. Aptik\u0119 po\u017eymi\u0173, laikykite svetain\u0119 visi\u0161kai kompromituota: pa\u0161alinkite kenk\u0117ji\u0161kus komponentus, panaikinkite neteis\u0117tas paskyras ir atkurkite patikim\u0105 administravimo prieig\u0105.<\/p>\n\n\n\n<p>Wordfence Premium, Care, Response ir mokamos Wordfence CLI versijos gavo \u0161io kompromitavimo aptikimo para\u0161us bei WAF taisykles 2026 m. rugpj\u016b\u010dio 7 d. Nemokami Wordfence ir Wordfence CLI naudotojai \u0161iuos para\u0161us bei taisykles gaus po \u012fprasto 30 dien\u0173 atid\u0117jimo.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Nuorodos \/ \u0160altiniai<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api\/\" target=\"_blank\" rel=\"noopener noreferrer\">PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>BdThemes \u012fskiepi\u0173 ataka vyko ne per atnaujinim\u0105, o per u\u017enuodyt\u0105 API atsakym\u0105. Patikrinkite, ar j\u016bs\u0173 WordPress svetain\u0117je neliko slapt\u0173 administratori\u0173, MU moduli\u0173 ir webshell p\u0117dsak\u0173.<\/p>\n","protected":false},"author":2,"featured_media":237,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[133,11,143,10,135],"class_list":["post-238","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-saugumas","tag-iskiepiai","tag-saugumas","tag-tiekimo-grandine","tag-wordpress","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/comments?post=238"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/posts\/238\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/media\/237"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/media?parent=238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/categories?post=238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/lt\/wp-json\/wp\/v2\/tags?post=238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}