{"id":227,"date":"2026-08-09T10:45:25","date_gmt":"2026-08-09T08:45:25","guid":{"rendered":"https:\/\/helloblog.io\/sk\/bdthemes-xss-utok-otravene-json-api\/"},"modified":"2026-08-09T10:45:25","modified_gmt":"2026-08-09T08:45:25","slug":"bdthemes-xss-utok-otravene-json-api","status":"publish","type":"post","link":"https:\/\/helloblog.io\/sk\/bdthemes-xss-utok-otravene-json-api\/","title":{"rendered":"BdThemes zasiahla supply-chain kompromit\u00e1cia cez otr\u00e1ven\u00e9 JSON API"},"content":{"rendered":"\n<p>\u00dato\u010dn\u00edci kompromitovali ekosyst\u00e9m pluginov BdThemes bez toho, aby zmenili jedin\u00fd s\u00fabor v ofici\u00e1lnom repozit\u00e1ri WordPress.org. Sta\u010dilo im prep\u00edsa\u0165 vzdialen\u00fd JSON feed s propaga\u010dn\u00fdmi bannermi: zranite\u013en\u00fd JavaScript ho na ka\u017edom na\u010d\u00edtan\u00ed <code>wp-admin<\/code> vlo\u017eil do DOM a spustil \u0161kodliv\u00fd k\u00f3d v rel\u00e1cii prihl\u00e1sen\u00e9ho administr\u00e1tora.<\/p>\n\n\n\n<p>Incident zasahuje sedem pluginov dostupn\u00fdch v ofici\u00e1lnom adres\u00e1ri. T\u00edm WordPress Plugins ich 7. augusta 2026 do\u010dasne uzavrel, k\u00fdm ich preveruje. Ke\u010f\u017ee \u00fatok nevy\u017eadoval aktualiz\u00e1ciu pluginu ani z\u00e1pis \u0161kodliv\u00e9ho s\u00faboru na disk, be\u017en\u00fd kontroln\u00fd s\u00fa\u010det s\u00faborov ho nemusel zachyti\u0165.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">\u010co urob teraz<\/h4>\n\n\n<p>Ak na webovej str\u00e1nke be\u017e\u00ed ktor\u00fdko\u013evek z dotknut\u00fdch pluginov, okam\u017eite skontroluj \u00fa\u010dty administr\u00e1torov, adres\u00e1re pluginov vr\u00e1tane <code>mu-plugins<\/code> a tabu\u013eku mo\u017enost\u00ed vo WordPress datab\u00e1ze. \u010cist\u00fd JSON na API endpointoch od 8. augusta 2026 neodstr\u00e1ni stopy z u\u017e napadnut\u00e9ho webu.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Ako sa \u00fatok dostal do administr\u00e1cie<\/h2>\n\n\n\n<p>Pluginy BdThemes obsahuj\u00fa intern\u00fd komponent <em>Biggopti<\/em>. Ten na hooku <code>admin_init<\/code> v\u017edy pripoj\u00ed klientsk\u00fd JavaScript, tak\u017ee sa spust\u00ed pri ka\u017edom na\u010d\u00edtan\u00ed \u013eubovo\u013enej str\u00e1nky vo <code>wp-admin<\/code>. Skript na\u010d\u00edta propaga\u010dn\u00e9 bannery z API dod\u00e1vate\u013ea a zostav\u00ed z nich HTML upozornenie v Document Object Model (DOM), teda stromovej reprezent\u00e1cii str\u00e1nky v prehliada\u010di.<\/p>\n\n\n\n<p>API nebe\u017ealo na dynamickom aplika\u010dnom serveri. Obsluhovali ho statick\u00e9 JSON s\u00fabory v DigitalOcean Spaces, pred ktor\u00fdmi st\u00e1l Cloudflare. Neopr\u00e1vnen\u00fd akt\u00e9r z\u00edskal pr\u00edstup na z\u00e1pis do tohto storage bucketu alebo do s\u00favisiacej internej infra\u0161trukt\u00fary BdThemes a nahradil legit\u00edmne odpovede upraven\u00fdm JSON-om.<\/p>\n\n\n\n<p>Chyba vznikla pri spracovan\u00ed po\u013ea <code>display_id<\/code>. K\u00f3d pou\u017eil vzdialen\u00fa hodnotu bez escapovania pri zostaven\u00ed HTML atrib\u00fatu <code>id<\/code>. V tom istom skripte sa atrib\u00fat <code>data-display-id<\/code> escapoval, tak\u017ee probl\u00e9m nebol v samotnom feede, ale v nekonzistentnom spracovan\u00ed jeho hodn\u00f4t na klientovi.<\/p>\n\n\n<a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/7bf1d6f9-afe2-41c2-968b-20dbc474cd73\" class=\"download-card\" download>\n                <span class=\"download-icon\"><i class=\"fa-duotone fa-file-code\"><\/i><\/span>\n                <span class=\"download-info\">\n                    <span class=\"download-title\">Zranite\u013en\u00e9 zostavenie atrib\u00fatu `id`<\/span>\n                    <span class=\"download-meta\"><span class=\"download-filename\">biggopti.js<\/span><\/span>\n                <\/span>\n                <span class=\"download-action\"><i class=\"fa-duotone fa-arrow-down-to-line\"><\/i><\/span>\n            <\/a>\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Hodnota display_id prich\u00e1dza zo vzdialen\u00e9ho JSON-u.\nvar f = t.display_id || t.id || &quot;default&quot;;\nvar m = &quot;bdt-admin-biggopti-api-biggopti-&quot; + f;\nA = 'id=&quot;' + m + '&quot;'; \/\/ bez escapovania\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Hodnota display_id prich\u00e1dza zo vzdialen\u00e9ho JSON-u.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> f <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> t.display_id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#E1E4E8\"> t.id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"default\"<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> \"bdt-admin-biggopti-api-biggopti-\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> f;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">A<\/span><span style=\"color:#F97583\"> =<\/span><span style=\"color:#9ECBFF\"> 'id=\"'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> '\"'<\/span><span style=\"color:#E1E4E8\">; <\/span><span style=\"color:#6A737D\">\/\/ bez escapovania<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>\u00dato\u010dn\u00edk vlo\u017eil do <code>display_id<\/code> ukon\u010denie atrib\u00fatu a handler <code>onanimationstart<\/code>. CSS anim\u00e1cia ho spustila pribli\u017ene do 10 ms po vykreslen\u00ed bannera, bez vidite\u013enej interakcie administr\u00e1tora. Handler potom na\u010d\u00edtal \u010fal\u0161\u00ed JavaScript z externej infra\u0161trukt\u00fary.<\/p>\n\n\n\n<p>Hist\u00f3ria SVN ukazuje, \u017ee neescapovan\u00e9 vlo\u017eenie do <code>id<\/code> pribudlo 1. marca 2026 v plugine Prime Slider vo verzii 4.1.9 (rev\u00edzia <code>r3471891<\/code>). Nesk\u00f4r sa dostalo aj do \u010fal\u0161\u00edch pluginov. V neskor\u0161\u00edch vydaniach pribudol sanitiz\u00e9r postaven\u00fd na <code>DOMParser<\/code>, ktor\u00fd odstr\u00e1nil nebezpe\u010dn\u00e9 HTML zna\u010dky a inline handlery z po\u013ea obsahu bannera, no atrib\u00fat <code>id<\/code> zostal zranite\u013en\u00fd.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ktor\u00e9 pluginy \u00fatok zasiahol<\/h2>\n\n\n\n<p>Zranite\u013enos\u0165 Biggopti je cross-site scripting (XSS) cez parameter <code>display_id<\/code> zo Sigmative API. M\u00e1 CVSS sk\u00f3re 5,4, teda stredn\u00fa z\u00e1va\u017enos\u0165, a v \u010dase incidentu neexistovala oprava. \u00dato\u010dn\u00edk v\u0161ak mus\u00ed najprv kompromitova\u0165 server API, \u010do sa v tomto pr\u00edpade stalo.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Element Pack Addons for Elementor (<code>bdthemes-element-pack-lite<\/code>)<\/li>\n\n\n<li>Prime Slider Addons for Elementor (<code>bdthemes-prime-slider-lite<\/code>)<\/li>\n\n\n<li>Pixel Gallery Addons for Elementor (<code>pixel-gallery<\/code>)<\/li>\n\n\n<li>Ultimate Post Kit Addons for Elementor (<code>ultimate-post-kit<\/code>)<\/li>\n\n\n<li>Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor (<code>ultimate-store-kit<\/code>)<\/li>\n\n\n<li>Live Copy Paste for Elementor (<code>live-copy-paste<\/code>)<\/li>\n\n\n<li>Smart Admin Assistant (<code>smart-admin-assistant<\/code>)<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Dve vetvy \u0161kodliv\u00e9ho payloadu<\/h2>\n\n\n\n<p>Napadnut\u00fd feed sp\u00fa\u0161\u0165al viacf\u00e1zov\u00fd \u00fatok a volil payload pod\u013ea dostupnosti infra\u0161trukt\u00fary \u00fato\u010dn\u00edka. Prim\u00e1rny <code>w2.js<\/code> dost\u00e1vali pluginy, ktor\u00e9 pou\u017e\u00edvali endpoint <code>api-data-all-records<\/code>. Sekund\u00e1rny <code>x.js<\/code> bol priamo ulo\u017een\u00fd v infra\u0161trukt\u00fare BdThemes a obsl\u00fa\u017eil pluginy s endpointom <code>api-data-records<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prim\u00e1rny payload <code>w2.js<\/code><\/h3>\n\n\n\n<p>Skript najprv kontaktoval C2 endpoint <code>ia-cdn[.]com\/fz\/c<\/code> a poslal mu origin napadnutej webovej str\u00e1nky. Ak C2 vr\u00e1tilo stav <code>skip<\/code> alebo <code>done<\/code>, \u00fatok skon\u010dil. V opa\u010dnom pr\u00edpade skript pou\u017eil <code>X-WP-Nonce<\/code> z akt\u00edvnej rel\u00e1cie administr\u00e1tora, aby cez WordPress REST API vytvoril nov\u00fd \u00fa\u010det administr\u00e1tora; ak API cesta zlyhala, pre\u0161iel na klasick\u00e9 odoslanie formul\u00e1ra.<\/p>\n\n\n\n<p>Potom stiahol ZIP, ktor\u00fd sa tv\u00e1ril ako plugin, a nahral ho \u0161tandardn\u00fdm formul\u00e1rom na nahr\u00e1vanie pluginov. Pou\u017e\u00edval nen\u00e1padn\u00fd slug <code>wp-smart-thumbnails<\/code> alebo podobn\u00e9 n\u00e1zvy. Falo\u0161n\u00fd plugin obsahoval webshell <code>emer-run.php<\/code>, ktor\u00fd \u00fato\u010dn\u00edk vyvolal priamo cez URL.<\/p>\n\n\n\n<p>Webshell nain\u0161taloval do adres\u00e1ra Must-Use pluginov dva perzistentn\u00e9 moduly. Vzorky mali \u010dasov\u00e9 pe\u010diatky upraven\u00e9 na september 2025, aby spl\u00fdvali s legit\u00edmnymi s\u00fabormi; n\u00e1zvy s\u00faborov sa medzi infekciami m\u00f4\u017eu meni\u0165. Prv\u00fd modul umo\u017enil prihl\u00e1senie administr\u00e1tora bez autentifik\u00e1cie cez parameter <code>?_wplogin=&lt;token&gt;<\/code> a cielil na najdlh\u0161ie registrovan\u00e9ho administr\u00e1tora. Druh\u00fd modul sa napojil na datab\u00e1zov\u00e9 dotazy WordPressu, skryl vytvoren\u00e9 \u00fa\u010dty zo zoznamu pou\u017e\u00edvate\u013eov v administr\u00e1cii a primerane zn\u00ed\u017eil aj celkov\u00fd po\u010det pou\u017e\u00edvate\u013eov.<\/p>\n\n\n\n<p>V\u00fdsledky jednotliv\u00fdch f\u00e1z payload odosielal na C2 pomocou <code>navigator.sendBeacon<\/code>. Tak\u00fdto prenos prehliada\u010d typicky dok\u00e1\u017ee odosla\u0165 aj pri op\u00fa\u0161\u0165an\u00ed str\u00e1nky.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Sekund\u00e1rny payload <code>x.js<\/code><\/h3>\n\n\n\n<p>Sekund\u00e1rny skript vytv\u00e1ral predv\u00eddate\u013en\u00e9 prihlasovacie \u00fadaje z hostname napadnutej webovej str\u00e1nky. Pre\u0161iel znaky hostname jednoduch\u00fdm 32-bitov\u00fdm hashom, absol\u00fatnu hodnotu previedol do base36 a pou\u017eil prv\u00fdch \u0161es\u0165 znakov. Pou\u017e\u00edvate\u013esk\u00e9 meno malo tvar <code>bd_<\/code> nasledovan\u00fd \u0161es\u0165znakov\u00fdm hashom, heslo tvar <code>Bd@26!<\/code> + hash + <code>x<\/code> a e-mail kon\u010dil na <code>@wordpress.org<\/code>.<\/p>\n\n\n\n<p>\u00dato\u010dn\u00edci preto nemuseli centr\u00e1lne uklada\u0165 zoznam kompromitovan\u00fdch webov: z dom\u00e9ny si vedeli \u00fadaje v\u017edy nanovo odvodi\u0165. Skript n\u00e1sledne cez formul\u00e1r <code>\/wp-admin\/user-new.php<\/code> vytvoril administr\u00e1tora, v\u00fdsledok vr\u00e1tane pou\u017e\u00edvate\u013esk\u00e9ho mena, hesla, originu webu, URL str\u00e1nky a odkazovej \u010dasti na odhl\u00e1senie odoslal na C2. Ak to prehliada\u010d dovolil, ulo\u017eil aj pr\u00edznak dokon\u010denia do <code>localStorage<\/code>, aby oper\u00e1ciu neopakoval.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Indik\u00e1tory kompromit\u00e1cie<\/h2>\n\n\n\n<p>Pri incidente h\u013eadaj tieto extern\u00e9 zdroje, s\u00fabory, mo\u017enosti a vzory \u00fa\u010dtov. Endpointy Sigmative u\u017e 8. augusta 2026 vracali \u010dist\u00fd JSON, no pri forenznej kontrole zost\u00e1vaj\u00fa relevantn\u00e9 ako d\u00f4kaz predch\u00e1dzaj\u00faceho napadnutia.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Prim\u00e1rny payload: <code>ia-cdn[.]com\/fz\/w2.js<\/code><\/li>\n\n\n<li>C2 beacon endpoint: <code>ia-cdn[.]com\/fz\/c<\/code><\/li>\n\n\n<li>Napadnut\u00fd endpoint: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-all-records<\/code><\/li>\n\n\n<li>Napadnut\u00fd endpoint: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-records<\/code><\/li>\n\n\n<li>Sekund\u00e1rny payload: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/x.js<\/code><\/li>\n\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Webshell <code>emer-run.php<\/code> s MD5 <code>1024732009983dd5e54b4cf5593f04d4<\/code><\/li>\n\n\n<li>MU-plugin magic-login backdoor <code>class-wp-token-validate.php<\/code> s MD5 <code>7719cd98a35ffad2771f26d1ceab7d27<\/code><\/li>\n\n\n<li>MU-plugin stealth modul <code>class-wp-query-9d127ff3.php<\/code> alebo podobn\u00fd n\u00e1zov pod\u013ea vzoru <code>class-wp-query-*.php<\/code>, s MD5 <code>9aadc3e5c5242b273bd17c5bdc358845<\/code><\/li>\n\n\n<li>MU-plugin \u201ehealth check\u201c modul <code>wp-cache-optimizer.php<\/code> s MD5 <code>e450ae5bc4bfc0d960dded06a76bb8e9<\/code><\/li>\n\n\n<li>Datab\u00e1zov\u00e1 mo\u017enos\u0165 <code>fz_emer_login_tokens<\/code>, ktor\u00e1 uklad\u00e1 tokeny magic loginu<\/li>\n\n\n<li>Datab\u00e1zov\u00e1 mo\u017enos\u0165 <code>fz_emer_done_v1<\/code>, ktor\u00e1 ozna\u010duje dokon\u010den\u00fa kompromit\u00e1ciu<\/li>\n\n\n<li>\u00da\u010dty s e-mailovou dom\u00e9nou <code>@wordpress.org<\/code> alebo <code>@developer.wordpress.org<\/code><\/li>\n\n\n<li>Pou\u017e\u00edvate\u013esk\u00e9 men\u00e1 pod\u013ea vzoru <code>bd_<\/code> + \u0161es\u0165 alfanumerick\u00fdch znakov<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u010casov\u00e1 os incidentu<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>1. marca 2026:<\/strong> Biggopti API JavaScript pribudol do Prime Slider 4.1.9 v SVN rev\u00edzii <code>r3471891<\/code>. Pole <code>display_id<\/code> sa vlo\u017eilo do atrib\u00fatu <code>id<\/code> bez escapovania a plugin pou\u017e\u00edval endpoint <code>api-data-records<\/code>.<\/li>\n\n\n<li><strong>10. m\u00e1ja 2026:<\/strong> Endpoint sa zmenil na <code>api-data-all-records<\/code>. Pole obsahu bannera za\u010dal \u010disti\u0165 <code>DOMParser<\/code>, no atrib\u00fat <code>id<\/code> zostal neescapovan\u00fd.<\/li>\n\n\n<li><strong>23. j\u00fana 2026:<\/strong> Za\u010dal sa d\u00e1tum kampane v napadnutom API, ozna\u010denej upozornen\u00edm \u201eSummer Sale\u201c. Od tohto d\u0148a mohol by\u0165 XSS najsk\u00f4r akt\u00edvny.<\/li>\n\n\n<li><strong>6. augusta 2026, 22:40 UTC:<\/strong> Napadnut\u00fd <code>api-data-records<\/code> mal posledn\u00fa zmenu.<\/li>\n\n\n<li><strong>7. augusta 2026, 09:11 UTC:<\/strong> Napadnut\u00fd <code>api-data-all-records<\/code> mal posledn\u00fa zmenu.<\/li>\n\n\n<li><strong>7. augusta 2026:<\/strong> Bezpe\u010dnostn\u00fd t\u00edm dostal hl\u00e1senie a pozoroval \u00fatok vo vo\u013enej pr\u00edrode. V ten ist\u00fd de\u0148 WordPress uzavrel pluginy v adres\u00e1ri, k\u00fdm ich preveruje.<\/li>\n\n\n<li><strong>7. augusta 2026, 16:56 UTC:<\/strong> Vy\u0161etrovatelia zachytili artefakty \u00fatoku.<\/li>\n\n\n<li><strong>8. augusta 2026:<\/strong> Oba API endpointy za\u010dali vraca\u0165 \u010dist\u00fd JSON.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Pre\u010do je tento \u00fatok odli\u0161n\u00fd<\/h2>\n\n\n\n<p>Kampa\u0148 s\u00favis\u00ed s rovnak\u00fdmi akt\u00e9rmi, ktor\u00ed st\u00e1li za ned\u00e1vnymi supply-chain \u00fatokmi na Advanced Responsive Video Embedder a OptinMonster. Cie\u013eom bolo ticho z\u00edska\u0165 perzistenciu administr\u00e1tora a vzdialen\u00e9 sp\u00fa\u0161\u0165anie k\u00f3du na ve\u013ekom po\u010dte WordPress prostred\u00ed.<\/p>\n\n\n\n<p>Tento pr\u00edpad ukazuje, \u017ee hranica d\u00f4very nekon\u010d\u00ed pri s\u00faboroch pluginu. Ak plugin v administr\u00e1cii bezpe\u010dne nespracuje vzdialen\u00fd obsah, kompromitovan\u00fd d\u00e1tov\u00fd kan\u00e1l dok\u00e1\u017ee z legit\u00edmneho banneru spravi\u0165 doru\u010dovac\u00ed mechanizmus malv\u00e9ru. Skontroluj v\u0161etky uveden\u00e9 indik\u00e1tory, odstr\u00e1\u0148 neopr\u00e1vnen\u00e9 \u00fa\u010dty a s\u00fabory a prever datab\u00e1zov\u00e9 mo\u017enosti sk\u00f4r, ne\u017e plugin znova aktivuje\u0161 alebo aktualizuje\u0161.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Detek\u010dn\u00e9 pravidl\u00e1<\/h4>\n\n\n<p>Platen\u00e9 varianty Wordfence Premium, Care, Response a Wordfence CLI dostali signat\u00fary malv\u00e9ru a pravidl\u00e1 WAF na detekciu tejto kompromit\u00e1cie 7. augusta 2026. Bezplatn\u00e9 Wordfence a bezplatn\u00e9 Wordfence CLI ich dostan\u00fa po \u0161tandardnom 30-d\u0148ovom odklade.<\/p>\n\n<\/div>\n\n\n<div class=\"references-section\">\n                <h2>Referencie \/ Zdroje<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response\/\" target=\"_blank\" rel=\"noopener noreferrer\">PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Jeden prep\u00edsan\u00fd JSON feed sta\u010dil na prevzatie WordPress administr\u00e1cie. Zisti, ktor\u00e9 BdThemes pluginy zasahuje XSS \u00fatok, ak\u00e9 perzistentn\u00e9 stopy zanech\u00e1va a \u010do mus\u00ed\u0161 na svojom webe skontrolova\u0165.<\/p>\n","protected":false},"author":38,"featured_media":226,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[37,63,139,10,130],"class_list":["post-227","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost","tag-bezpecnost","tag-pluginy","tag-supply-chain","tag-wordpress","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts\/227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/comments?post=227"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/posts\/227\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/media\/226"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/media?parent=227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/categories?post=227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/sk\/wp-json\/wp\/v2\/tags?post=227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}