{"id":251,"date":"2026-08-09T10:42:53","date_gmt":"2026-08-09T08:42:53","guid":{"rendered":"https:\/\/helloblog.io\/lv\/bdthemes-api-piegades-kedes-kompromitejums\/"},"modified":"2026-08-09T10:42:53","modified_gmt":"2026-08-09T08:42:53","slug":"bdthemes-api-piegades-kedes-kompromitejums","status":"publish","type":"post","link":"https:\/\/helloblog.io\/lv\/bdthemes-api-piegades-kedes-kompromitejums\/","title":{"rendered":"BdThemes API pieg\u0101des \u0137\u0113des kompromit\u0113jums: ko p\u0101rbaud\u012bt WordPress vietn\u0113"},"content":{"rendered":"\n<p>BdThemes spraud\u0146u ekosist\u0113m\u0101 ir atkl\u0101ts pieg\u0101des \u0137\u0113des kompromit\u0113jums, kur uzbruc\u0113ji neizmain\u012bja nevienu failu WordPress.org repozitorij\u0101. T\u0101 viet\u0101 vi\u0146i \u013caunpr\u0101t\u012bgi main\u012bja att\u0101lu JSON datu pl\u016bsmu, ko spraud\u0146i izmantoja administr\u0101cijas rekl\u0101mas pazi\u0146ojumiem, un ieguva iesp\u0113ju izpild\u012bt JavaScript autoriz\u0113tu administratoru p\u0101rl\u016bkos.<\/p>\n\n\n\n<p>Skartie spraud\u0146i WordPress spraud\u0146u katalog\u0101 ir uz laiku sl\u0113gti, kam\u0113r WordPress Plugins komanda tos p\u0101rbauda. Ja vietn\u0113 darbojas k\u0101ds no \u0161iem spraud\u0146iem, nepietiek ar failu integrit\u0101tes p\u0101rbaudi: j\u0101p\u0101rskata lietot\u0101ji, spraud\u0146u direktoriji un datub\u0101zes opcijas.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">K\u0101p\u0113c tas ir b\u012bstami<\/h4>\n\n\n<p>Uzbrukums neprasa spraud\u0146a atjaunin\u0101jumu un nemaina failus servera disk\u0101. \u013baunpr\u0101t\u012bgais kods iel\u0101d\u0113jas katr\u0101 <code>wp-admin<\/code> lapas atv\u0113r\u0161anas reiz\u0113, ja administrators ir pieteicies.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0101 darbojas kompromit\u0113jums<\/h2>\n\n\n\n<p>BdThemes spraud\u0146os ir iek\u013cauts iek\u0161\u0113js komponents <em>Biggopti<\/em>. Tas no pieg\u0101d\u0101t\u0101ja API iel\u0101d\u0113 rekl\u0101mas banerus un par\u0101da tos WordPress administr\u0101cijas panel\u012b. API nav dinamisks lietot\u0146u serveris: tas apkalpo statiskus JSON failus no DigitalOcean Spaces objektu kr\u0101tuves, kuru aizsarg\u0101 Cloudflare.<\/p>\n\n\n\n<p>Spraud\u0146u autora JavaScript kod\u0101 bija XSS (cross-site scripting jeb starpviet\u0146u skript\u0113\u0161anas) ievainojam\u012bba. Uzbruc\u0113ji ieguva rakst\u012b\u0161anas piek\u013cuvi \u0161ai objektu kr\u0101tuvei, aizst\u0101ja le\u0123it\u012bm\u0101s JSON atbildes ar sagatavotiem datiem un izmantoja ievainojam\u012bbu administratora sesij\u0101.<\/p>\n\n\n\n<p>Katrs BdThemes spraudnis, kas izmanto Biggopti, <code>admin_init<\/code> hook laik\u0101 piesaista klienta puses JavaScript. T\u0101p\u0113c skripts darbojas bez nosac\u012bjumiem ikreiz, kad iel\u0101d\u0113 jebkuru <code>wp-admin<\/code> lapu. Tas sa\u0146em banera datus no API un ievieto att\u0101l\u0101 JSON lauka <code>display_id<\/code> v\u0113rt\u012bbu HTML <code>id<\/code> atrib\u016bt\u0101 bez ekr\u0101n\u0113\u0161anas.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ display_id v\u0113rt\u012bbu ievieto DOM bez ekr\u0101n\u0113\u0161anas\nvar f = t.display_id || t.id || &quot;default&quot;;\nvar m = &quot;bdt-admin-biggopti-api-biggopti-&quot; + f;\nA = 'id=&quot;' + m + '&quot;';\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ display_id v\u0113rt\u012bbu ievieto DOM bez ekr\u0101n\u0113\u0161anas<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> f <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> t.display_id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#E1E4E8\"> t.id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"default\"<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> \"bdt-admin-biggopti-api-biggopti-\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> f;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">A<\/span><span style=\"color:#F97583\"> =<\/span><span style=\"color:#9ECBFF\"> 'id=\"'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> '\"'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Taj\u0101 pa\u0161\u0101 kod\u0101 <code>data-display-id<\/code> atrib\u016btam bija atsevi\u0161\u0137a ekr\u0101n\u0113\u0161anas funkcija. T\u0101 aizst\u0101j <code>&amp;<\/code>, <code>&lt;<\/code>, <code>&gt;<\/code> un p\u0113di\u0146as ar HTML ent\u012btij\u0101m, ta\u010du <code>id<\/code> atrib\u016bta veido\u0161an\u0101 \u0161o funkciju neizmantoja.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function escapeAttribute(value) {\n  return (value || &quot;&quot;)\n    .replace(\/&amp;\/g, &quot;&amp;amp;&quot;)\n    .replace(\/&lt;\/g, &quot;&amp;lt;&quot;)\n    .replace(\/&gt;\/g, &quot;&amp;gt;&quot;)\n    .replace(\/&quot;\/g, &quot;&amp;quot;&quot;);\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> escapeAttribute<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#FFAB70\">value<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> (value <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x26;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;amp;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x3C;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;lt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">><\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;gt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">\"<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;quot;\"<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>SVN v\u0113sture r\u0101da, ka neekran\u0113to atrib\u016bta ievieto\u0161anu Prime Slider spraud\u0146a <code>bdthemes-prime-slider-lite<\/code> versij\u0101 4.1.9 pievienoja 2026. gada 1. mart\u0101, p\u0113c tam to p\u0101rnesa uz citiem spraud\u0146iem. V\u0113l\u0101k\u0101s versij\u0101s banera <code>content<\/code> laukam pievienoja uz <code>DOMParser<\/code> balst\u012btu sanitiz\u0113t\u0101ju, kas izmet b\u012bstamus HTML tagus un inline apstr\u0101d\u0101t\u0101jus, bet <code>id<\/code> atrib\u016bts palika neaizsarg\u0101ts.<\/p>\n\n\n\n<p>\u013baunpr\u0101t\u012bgais <code>display_id<\/code> aizver <code>id<\/code> atrib\u016btu un pievieno <code>onanimationstart<\/code> notikuma apstr\u0101d\u0101t\u0101ju. CSS anim\u0101cija to aktiviz\u0113 aptuveni 10 milisekund\u0113s, t\u0101d\u0113\u013c kods klusi nostr\u0101d\u0101, administratoram atverot jebkuru pane\u013ca lapu. \u013baunpr\u0101t\u012bgaj\u0101 API ierakst\u0101 bija ar\u012b \u0161\u0137ietami parasts banera virsraksts \u201cBuild more. Pay less. This Summer\u201d.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ievainojam\u012bba un skartie spraud\u0146i<\/h2>\n\n\n\n<p>Biggopti bibliot\u0113k\u0101 <code>display_id<\/code> parametrs no Sigmative API \u013cauj izrais\u012bt XSS, jo izvade nav pietiekami ekr\u0101n\u0113ta. Uzbruc\u0113js, kas kompromit\u0113 Sigmative API serveri, var ievietot patva\u013c\u012bgu t\u012bmek\u013ca skriptu lap\u0101s, kur\u0101s iel\u0101d\u0113 infic\u0113to ierakstu.<\/p>\n\n\n\n<p>Ievainojam\u012bbai pie\u0161\u0137irts CVSS v\u0113rt\u0113jums <strong>5,4 (vid\u0113js)<\/strong>, un tai nav labojuma. T\u0101 skar \u0161\u0101du programmat\u016bru:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/bdthemes-element-pack-lite\">Element Pack Addons for Elementor &#8211; Elementor Widgets, Elementor Templates, Elementor Addons<\/a> &#8211; <code>bdthemes-element-pack-lite<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/live-copy-paste\">Live Copy Paste for Elementor &#8211; Cross Domain Copy Paste &#038; Page Duplicator<\/a> &#8211; <code>live-copy-paste<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/pixel-gallery\">Pixel Gallery Addons for Elementor &#8211; Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery<\/a> &#8211; <code>pixel-gallery<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/bdthemes-prime-slider-lite\">Prime Slider Addons for Elementor &#8211; Widgets, Templates &#038; Elementor Addons<\/a> &#8211; <code>bdthemes-prime-slider-lite<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/smart-admin-assistant\">Smart Admin Assistant &#8211; Dashboard and Site Enhancements<\/a> &#8211; <code>smart-admin-assistant<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/ultimate-post-kit\">Ultimate Post Kit Addons for Elementor<\/a> &#8211; <code>ultimate-post-kit<\/code><\/li>\n\n\n<li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/ultimate-store-kit\">Ultimate Store Kit &#8211; Addon For WooCommerce, EDD and Elementor<\/a> &#8211; <code>ultimate-store-kit<\/code><\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Divi \u013caunpr\u0101t\u012bgie izpildes ce\u013ci<\/h2>\n\n\n\n<p>Ievad\u012btais notikuma apstr\u0101d\u0101t\u0101js iel\u0101d\u0113 \u0101r\u0113jus skriptus vair\u0101kos posmos. Tas izv\u0113las pieejamo uzbruc\u0113ju infrastrukt\u016bru, t\u0101d\u0113\u013c kampa\u0146\u0101 bija divi at\u0161\u0137ir\u012bgi payload ce\u013ci.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prim\u0101rais payload: w2.js<\/h3>\n\n\n\n<p>Spraud\u0146i, kas izmanto <code>api-data-all-records<\/code> endpoint, iel\u0101d\u0113ja galveno <code>w2.js<\/code> payload. Tas darboj\u0101s jau autoriz\u0113ta administratora sesij\u0101 un izpild\u012bja \u0161\u0101das darb\u012bbas:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>P\u0101rbauda C2 serveri.<\/strong> Skripts s\u016bta vietnes origin uz <code>ia-cdn[.]com\/fz\/c<\/code>, lai sa\u0146emtu nor\u0101des par m\u0113r\u0137\u0113\u0161anu. Ja serveris atbild ar statusu <code>skip<\/code> vai <code>done<\/code>, skripts p\u0101rtrauc darbu.<\/li>\n\n\n<li><strong>Izveido neat\u013cautu administratoru.<\/strong> Tas izmanto akt\u012bvaj\u0101 administratora sesij\u0101 pieejamo <code>X-WP-Nonce<\/code>, lai caur WordPress REST API pievienotu administratoru. Ja tas neizdodas, skripts m\u0113\u0123ina nos\u016bt\u012bt parastu administr\u0101cijas formas piepras\u012bjumu.<\/li>\n\n\n<li><strong>Instal\u0113 webshell.<\/strong> Skripts no C2 servera lejupiel\u0101d\u0113 viltota spraud\u0146a ZIP arh\u012bvu un aug\u0161upiel\u0101d\u0113 to caur standarta spraud\u0146u instal\u0113\u0161anas formu. Viltus spraudnis mask\u0113jas ar slug <code>wp-smart-thumbnails<\/code> vai l\u012bdz\u012bgu neitr\u0101lu nosaukumu, bet taj\u0101 ir webshell <code>emer-run.php<\/code>, ko izsauc tie\u0161i ar URL.<\/li>\n\n\n<li><strong>Izveido Must-Use (MU) spraud\u0146u aizmugures piek\u013cuves.<\/strong> <code>emer-run.php<\/code> Must-Use spraud\u0146u direktorij\u0101 instal\u0113 divus notur\u012bbas modu\u013cus. Abi ieg\u016btie paraugi bija dat\u0113ti ar 2025. gada septembri, lai sapl\u016bstu ar le\u0123it\u012bmiem failu laika z\u012bmogiem, tom\u0113r failu nosaukumi da\u017e\u0101d\u0101s infekcij\u0101s var at\u0161\u0137irties. Pirmais modulis izveido ma\u0123isk\u0101s pieteik\u0161an\u0101s aizmugures piek\u013cuvi: ar URL parametru <code>?_wplogin=&lt;token&gt;<\/code> var bez autentifik\u0101cijas ieg\u016bt administratora piek\u013cuvi vietnes visilg\u0101k re\u0123istr\u0113t\u0101 administratora v\u0101rd\u0101. Otrais modulis sl\u0113pj uzbrukumu anal\u012bzes laik\u0101: tas piesaist\u0101s WordPress datub\u0101zes vaic\u0101jumiem, pasl\u0113pj izveidotos neat\u013cautos kontus administr\u0101cijas lietot\u0101ju sarakst\u0101 un atbilsto\u0161i samazina kop\u0113jo lietot\u0101ju skaitu.<\/li>\n\n\n<li><strong>Nos\u016bta izpildes rezult\u0101tus.<\/strong> Skripts katra posma rezult\u0101tus nodod C2 serverim ar <code>navigator.sendBeacon<\/code>.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Alternat\u012bvais payload: x.js<\/h3>\n\n\n\n<p>Spraud\u0146i, kas izmanto <code>api-data-records<\/code> endpoint, sa\u0146\u0113ma sekund\u0101ro <code>x.js<\/code> skriptu, kas bija izvietots tie\u0161i BdThemes infrastrukt\u016br\u0101. Tas no vietnes hosta nosaukuma matem\u0101tiski atvasina deterministiskus administratora piek\u013cuves datus.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function makeCreds() {\n  var host = siteKey();\n  var hash = 0;\n\n  for (var i = 0; i &lt; host.length; i++) {\n    hash = ((hash &lt;&lt; 5) - hash + host.charCodeAt(i)) | 0;\n  }\n\n  var n = Math.abs(hash).toString(36).slice(0, 6);\n  return {\n    user: &quot;bd_&quot; + n,\n    pass: &quot;Bd@26!&quot; + n + &quot;x&quot;\n  };\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> makeCreds<\/span><span style=\"color:#E1E4E8\">() {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> host <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> siteKey<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> hash <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  for<\/span><span style=\"color:#E1E4E8\"> (<\/span><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> i <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">; i <\/span><span style=\"color:#F97583\">&#x3C;<\/span><span style=\"color:#E1E4E8\"> host.<\/span><span style=\"color:#79B8FF\">length<\/span><span style=\"color:#E1E4E8\">; i<\/span><span style=\"color:#F97583\">++<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    hash <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> ((hash <\/span><span style=\"color:#F97583\">&#x3C;&#x3C;<\/span><span style=\"color:#79B8FF\"> 5<\/span><span style=\"color:#E1E4E8\">) <\/span><span style=\"color:#F97583\">-<\/span><span style=\"color:#E1E4E8\"> hash <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#E1E4E8\"> host.<\/span><span style=\"color:#B392F0\">charCodeAt<\/span><span style=\"color:#E1E4E8\">(i)) <\/span><span style=\"color:#F97583\">|<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">  }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> n <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> Math.<\/span><span style=\"color:#B392F0\">abs<\/span><span style=\"color:#E1E4E8\">(hash).<\/span><span style=\"color:#B392F0\">toString<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">36<\/span><span style=\"color:#E1E4E8\">).<\/span><span style=\"color:#B392F0\">slice<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">0<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#79B8FF\">6<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    user: <\/span><span style=\"color:#9ECBFF\">\"bd_\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> n,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    pass: <\/span><span style=\"color:#9ECBFF\">\"Bd@26!\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> n <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> \"x\"<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">  };<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Algoritms veido lietot\u0101jv\u0101rdu <code>bd_<\/code> un se\u0161u rakstz\u012bmju base36 hash kombin\u0101cij\u0101, k\u0101 ar\u012b paroli <code>Bd@26!<\/code>, hash un burtu <code>x<\/code>. Tam piesaista e-pasta adresi ar dom\u0113nu <code>@wordpress.org<\/code>. T\u0101 k\u0101 \u0161ie dati ir deterministiski, uzbruc\u0113jiem nav centr\u0101li j\u0101glab\u0101 kompromit\u0113to viet\u0146u saraksts; incidenta izmekl\u0113t\u0101js var apr\u0113\u0137in\u0101t mekl\u0113jamo lietot\u0101jv\u0101rdu un paroli aizdom\u012bgai vietnei.<\/p>\n\n\n\n<p>P\u0113c tam <code>x.js<\/code> ar \u0161iem datiem izveido neat\u013cautu administratoru, nos\u016bta izn\u0101kumu uz C2 serveri ar <code>navigator.sendBeacon<\/code> vai rezerves <code>fetch<\/code> POST piepras\u012bjumu un, ja iesp\u0113jams, p\u0101rl\u016bk\u0101 saglab\u0101 <code>localStorage<\/code> karodzi\u0146u. Skripts vispirms iel\u0101d\u0113 <code>\/wp-admin\/user-new.php<\/code>, atrod nonce, nos\u016bta administratora izveides formu un zi\u0146o statusu <code>created<\/code>, <code>exists<\/code>, <code>fail<\/code>, <code>nonce_missing<\/code> vai <code>err<\/code>; tas vairs nem\u0113\u0123ina darb\u012bbu, ja atrod jau saglab\u0101tu pabeig\u0161anas karodzi\u0146u.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kampa\u0146as tv\u0113rums un iesp\u0113jam\u0101 izcelsme<\/h2>\n\n\n\n<p>C2 dom\u0113ns ir saist\u012bts ar tiem pa\u0161iem uzbruc\u0113jiem, kuri p\u0113d\u0113jo divu m\u0113ne\u0161u laik\u0101 veica <a href=\"https:\/\/www.wordfence.com\/blog\/2026\/07\/wordfence-prism-detected-backdoored-wordpress-plugin-within-two-hours-of-it-being-introduced\/\">Advanced Responsive Video Embedder<\/a> un <a href=\"https:\/\/optinmonster.com\/security-incident-tampered-script-served-via-optinmonster-and-trustpulse\/#what-to-check-and-do\">OptinMonster<\/a> pieg\u0101des \u0137\u0113des uzbrukumus.<\/p>\n\n\n\n<p>Kampa\u0146as m\u0113r\u0137is ir klusi un pla\u0161i ieg\u016bt notur\u012bgu administratora piek\u013cuvi un att\u0101lin\u0101tas koda izpildes iesp\u0113ju WordPress vid\u0113s. \u0160aj\u0101 gad\u012bjum\u0101 uzbruc\u0113jiem nevajadz\u0113ja piek\u013c\u016bt pa\u0161\u0101m vietn\u0113m: pietika kompromit\u0113t uzticamu rekl\u0101mas datu pl\u016bsmu, lai ievainojamais att\u0113lo\u0161anas kods p\u0101rv\u0113rstu administr\u0101cijas pazi\u0146ojumu par \u013caunprogrammat\u016bras pieg\u0101des kan\u0101lu.<\/p>\n\n\n\n<p>Fakts, ka \u013caunpr\u0101t\u012bgie JSON ieraksti un sekund\u0101rais <code>x.js<\/code> payload tika aug\u0161upiel\u0101d\u0113ti pieg\u0101d\u0101t\u0101ja kr\u0101tuv\u0113, nor\u0101da uz nopietnu BdThemes m\u0101ko\u0146kr\u0101tuves piek\u013cuves datu vai iek\u0161\u0113j\u0101s infrastrukt\u016bras kompromit\u0113jumu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kompromit\u0113juma indikatori<\/h2>\n\n\n\n<p>P\u0101rbaudi servera piepras\u012bjumu \u017eurn\u0101lus, failu sist\u0113mu, datub\u0101zi un WordPress lietot\u0101jus p\u0113c \u0161iem indikatoriem. Indikatori aptver gan s\u0101kotn\u0113jo skriptu iel\u0101di, gan notur\u012bbas meh\u0101nismus p\u0113c administratora piek\u013cuves ieg\u016b\u0161anas.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u0100r\u0113jie resursi<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Prim\u0101r\u0101 payload adrese: <code>ia-cdn[.]com\/fz\/w2.js<\/code><\/li>\n\n\n<li>C2 beacon endpoint: <code>ia-cdn[.]com\/fz\/c<\/code><\/li>\n\n\n<li>Kompromit\u0113tais pieg\u0101d\u0101t\u0101ja API endpoint, kas tagad atdod t\u012bru JSON: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-all-records<\/code><\/li>\n\n\n<li>Kompromit\u0113tais pieg\u0101d\u0101t\u0101ja API endpoint, kas tagad atdod t\u012bru JSON: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-records<\/code><\/li>\n\n\n<li>Kompromit\u0113t\u0101 pieg\u0101d\u0101t\u0101ja skripta adrese: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/x.js<\/code><\/li>\n\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Faili, datub\u0101ze un lietot\u0101ji<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Webshell fails <code>emer-run.php<\/code>, MD5: <code>1024732009983dd5e54b4cf5593f04d4<\/code>.<\/li>\n\n\n<li>MU spraud\u0146a ma\u0123isk\u0101s pieteik\u0161an\u0101s aizmugures piek\u013cuves fails <code>class-wp-token-validate.php<\/code>, MD5: <code>7719cd98a35ffad2771f26d1ceab7d27<\/code>.<\/li>\n\n\n<li>MU spraud\u0146a sl\u0113p\u0161anas modulis <code>class-wp-query-9d127ff3.php<\/code> vai l\u012bdz\u012bgs nosaukums <code>class-wp-query-*.php<\/code>, MD5: <code>9aadc3e5c5242b273bd17c5bdc358845<\/code>.<\/li>\n\n\n<li>MU spraud\u0146a \u201cHealth Check\u201d modulis <code>wp-cache-optimizer.php<\/code>, MD5: <code>e450ae5bc4bfc0d960dded06a76bb8e9<\/code>.<\/li>\n\n\n<li>Datub\u0101zes opcija <code>fz_emer_login_tokens<\/code>, kas glab\u0101 ma\u0123isk\u0101s pieteik\u0161an\u0101s tokenus.<\/li>\n\n\n<li>Datub\u0101zes opcija <code>fz_emer_done_v1<\/code>, kas nor\u0101da uz pabeigtu kompromit\u0113jumu.<\/li>\n\n\n<li>Lietot\u0101ju konti ar e-pasta dom\u0113nu <code>@wordpress.org<\/code> vai <code>@developer.wordpress.org<\/code>.<\/li>\n\n\n<li>Lietot\u0101jv\u0101rdi form\u0101t\u0101 <code>bd_<\/code> un se\u0161as burtciparu rakstz\u012bmes.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Notikumu laika l\u012bnija<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>2026. gada 1. marts:<\/strong> Prime Slider 4.1.9 versijai pievieno Biggopti API JavaScript (SVN <code>r3471891<\/code>). <code>display_id<\/code> non\u0101k <code>id<\/code> atrib\u016bt\u0101 bez ekr\u0101n\u0113\u0161anas, un spraudnis izmanto <code>api-data-records<\/code> endpoint.<\/li>\n\n\n<li><strong>2026. gada 10. maijs:<\/strong> endpoint nomaina uz <code>api-data-all-records<\/code>. <code>content<\/code> laukam pievieno <code>DOMParser<\/code> sanitiz\u0113t\u0101ju, bet <code>id<\/code> atrib\u016bts paliek neekran\u0113ts.<\/li>\n\n\n<li><strong>2026. gada 23. j\u016bnijs:<\/strong> kompromit\u0113t\u0101s API kampa\u0146as ieraksta <code>start_date<\/code> ir \u201cSummer Sale\u201d pazi\u0146ojumam. \u0160is ir agr\u0101kais iesp\u0113jamais datums, kad XSS var\u0113ja b\u016bt akt\u012bvs.<\/li>\n\n\n<li><strong>2026. gada 6. augusts, 22:40 UTC:<\/strong> p\u0113d\u0113j\u0101s izmai\u0146as laiks kompromit\u0113tajam <code>api-data-records<\/code> endpoint.<\/li>\n\n\n<li><strong>2026. gada 7. augusts, 09:11 UTC:<\/strong> p\u0113d\u0113j\u0101s izmai\u0146as laiks kompromit\u0113tajam <code>api-data-all-records<\/code> endpoint.<\/li>\n\n\n<li><strong>2026. gada 7. augusts:<\/strong> par uzbrukumu pazi\u0146o draudu izl\u016bko\u0161anas komandai un uzbrukumu nov\u0113ro re\u0101l\u0101 vid\u0113.<\/li>\n\n\n<li><strong>2026. gada 7. augusts:<\/strong> skartos spraud\u0146us WordPress katalog\u0101 sl\u0113dz l\u012bdz p\u0101rbaudes pabeig\u0161anai.<\/li>\n\n\n<li><strong>2026. gada 7. augusts, 16:56 UTC:<\/strong> saglab\u0101 izmekl\u0113\u0161anas artefaktus.<\/li>\n\n\n<li><strong>2026. gada 8. augusts:<\/strong> abi API endpoint atkal atdod t\u012bru JSON.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Ko dar\u012bt skarto viet\u0146u uztur\u0113t\u0101jiem<\/h2>\n\n\n\n<p>Nekav\u0113joties noskaidro, vai vietn\u0113 darbojas k\u0101ds no septi\u0146iem skartajiem BdThemes spraud\u0146iem. P\u0113c tam p\u0101rskati WordPress lietot\u0101ju sarakstu, \u012bpa\u0161i kontus ar <code>bd_<\/code> prefiksu un <code>@wordpress.org<\/code> vai <code>@developer.wordpress.org<\/code> e-pasta adres\u0113m, k\u0101 ar\u012b p\u0101rbaudi MU spraud\u0146u direktoriju, parasto spraud\u0146u direktoriju un datub\u0101zes opciju tabulu p\u0113c visiem nor\u0101d\u012btajiem indikatoriem.<\/p>\n\n\n\n<p>Neuzticies tikai failu integrit\u0101tes skenerim vai WAF: \u0161is uzbrukums s\u0101kotn\u0113ji izmantoja att\u0101lu API atbildi, t\u0101p\u0113c spraud\u0146u faili disk\u0101 var palikt nemain\u012bti. Ja atrodi indikatorus, apstr\u0101d\u0101 vietni k\u0101 piln\u012bb\u0101 kompromit\u0113tu, no\u0146em neat\u013cautos kontus un \u013caunpr\u0101t\u012bgos failus, izt\u012bri datub\u0101zes opcijas un p\u0101rbaudi visas notur\u012bbas p\u0113das.<\/p>\n\n\n\n<p>Wordfence Premium, Care un Response lietot\u0101ji, k\u0101 ar\u012b maksas Wordfence CLI klienti sa\u0146\u0113ma \u013caunprogrammat\u016bras signat\u016bras un WAF noteikumus \u0161\u012b kompromit\u0113juma noteik\u0161anai 2026. gada 7. august\u0101. Wordfence bezmaksas un Wordfence CLI bezmaksas lietot\u0101ji \u0161\u012bs signat\u016bras un noteikumus sa\u0146ems p\u0113c standarta 30 dienu aizkaves.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Atsauces \/ Avoti<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response\/\" target=\"_blank\" rel=\"noopener noreferrer\">PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>BdThemes pieg\u0101des \u0137\u0113des kompromit\u0113jums izmantoja att\u0101lu JSON baneru pl\u016bsmu, nevis modific\u0113tus spraud\u0146u failus. P\u0101rbaudi administratoru kontus, MU spraud\u0146us un datub\u0101zes opcijas, ja vietn\u0113 darbojas k\u0101ds no skartajiem spraud\u0146iem.<\/p>\n","protected":false},"author":52,"featured_media":250,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[36,141,129,10,74],"class_list":["post-251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-drosiba","tag-drosiba","tag-launprogrammatura","tag-piegades-kede","tag-wordpress","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/posts\/251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/users\/52"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/comments?post=251"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/posts\/251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/media\/250"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/media?parent=251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/categories?post=251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/tags?post=251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}