Forminator and BdThemes Hacks: Is Your WordPress Site Affected?

Short answer: if you run the Forminator Forms plugin or any of seven specific BdThemes/Elementor add-ons, your site may have been exposed to a takeover bug sometime in the last few weeks — but both issues already have fixes, and checking whether you're affected takes about five minutes. This post walks through exactly what happened, how to tell if it touched your site, and what to do next, without the deep infosec jargon most of the coverage on this is written in.

What happened with Forminator Forms

Forminator Forms is a popular drag-and-drop form builder used on well over half a million WordPress sites for things like contact forms, quizzes, polls, and file-upload forms. A security researcher found a way for someone with no login at all to upload a file disguised as something harmless and have the server treat it as executable code — the kind of bug that hands over full control of a site if it's left unpatched. The flaw only affects sites where a form combines a File Upload field with a Select field, but a huge number of Forminator forms do exactly that without the site owner realizing it's a risk.

The good news: the plugin's developers shipped a fix version within about two weeks of being told, and the version affected is clearly defined — anything before the patched release.

What happened with BdThemes / Elementor add-ons

This one is sneakier, because it didn't require a plugin update to become dangerous. Several BdThemes plugins — commonly used to extend Elementor with extra design widgets — quietly pull promotional banners from an external data feed to show inside your WordPress admin area. Attackers managed to tamper with that external feed itself, not the plugin code sitting on your server. Because the compromised data was injected through a feed the plugin already trusted, sites running an affected plugin were exposed even if the plugin files hadn't been touched at all.

The tampered feed could inject scripts that create a hidden admin account or drop a backdoor file onto the server, all without ever modifying a single line of the plugin's actual code — which is exactly why this kind of attack is so easy to miss in a routine file scan.

Which plugins were affected

How to check if your site was actually hit

1. Go to Plugins → Installed Plugins and check whether you're running Forminator Forms or any plugin from the table above.
2. If you find one, check its version number against the developer's latest release notes — if you're behind, update immediately.
3. Go to Users → All Users and look for any administrator account you don't recognize, especially anything created recently that you didn't set up yourself.
4. Check your site's file manager or FTP for unfamiliar PHP files sitting in your uploads folder — a legitimate uploads folder should only ever contain images, PDFs, and similar media, never executable code.
5. If your host offers a malware scan (most decent hosts do), run it now rather than waiting for your next scheduled scan.

If you find something suspicious

Don't panic, but don't wait either. Change your WordPress admin password and your hosting account password right away, remove any admin account you didn't create, and delete any PHP file in your uploads directory that shouldn't be there. If you're not confident doing this yourself, most hosts have a malware cleanup service, and dedicated security tools exist specifically for this — our open source cybersecurity tools guide covers free scanners that can help you double-check your work.

What this means if you're on Blogger instead

If your blog runs on Blogger rather than WordPress, neither of these specific vulnerabilities applies to you directly — Blogger doesn't use third-party plugins the same way. But the underlying lesson still does: unfamiliar admin accounts, injected scripts, and unexplained content changes are exactly what Google looks for when it slaps a "hacked content" flag on a site. If you've ever seen that warning yourself, our post on getting a locked Blogger blog restored walks through the exact recovery steps, and the broader deindexing guide covers what Google's systems are actually looking for.

Frequently Asked Questions

Q1. What is the Forminator vulnerability?

It's a critical bug in the Forminator Forms WordPress plugin that lets an attacker with no login upload a malicious file to your server and potentially take full control of your site, if your form combines a File Upload field with a Select field.

Q2. Is my site affected by the Forminator bug?

Only if you're running Forminator Forms on a version older than the patched release, and only if at least one of your forms uses both a File Upload field and a Select field. Check your plugin version first.

Q3. What is the BdThemes supply-chain attack?

Attackers compromised an external data feed that several BdThemes/Elementor add-ons use to display promotional banners inside the WordPress dashboard, allowing malicious code to run on sites using those plugins without the plugin files themselves being altered.

Q4. Which plugins were affected by the BdThemes attack?

Element Pack Addons, Prime Slider Addons, Pixel Gallery Addons, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste, and Smart Admin Assistant — all from BdThemes.

Q5. How do I know if my site was actually compromised, not just exposed?

Check for admin accounts you don't recognize and unfamiliar PHP files in your uploads folder. Exposure means you were vulnerable; compromise means someone actually got in — the checklist above helps you tell the difference.

Q6. What should I do if I'm running a vulnerable plugin but see no signs of a hack?

Update immediately regardless. Being exposed without visible signs of compromise doesn't mean nothing happened — some backdoors are designed specifically to stay hidden.

Q7. Is Blogger affected by these vulnerabilities?

No, these are WordPress-specific plugin issues. Blogger doesn't run third-party plugins the same way, so this exact bug can't affect a Blogger site.

Q8. Do I need a dedicated security plugin if none of this affects me?

It's still worth having one. Incidents like this happen regularly, and a security plugin that scans for unfamiliar files and monitors admin accounts catches problems long before you'd notice them manually.

Q9. How can I get alerted about vulnerabilities like this in the future?

Most WordPress security plugins send email alerts when a plugin you're running gets a vulnerability disclosure. That's generally faster than waiting to hear about it from tech news.

Q10. Is it too late to fix my site if it's already been compromised?

No, but act quickly. Change your passwords, remove unauthorized admin accounts, delete suspicious files, and consider a professional malware cleanup if you're not confident doing it yourself.

Q11. Does this affect Elementor itself?

No. Elementor itself was not the source of the vulnerability — this was specific to certain third-party add-ons built to extend Elementor, not the core Elementor plugin.

Q12. Should I stop using Elementor add-ons altogether because of this?

Not necessarily. The issue was with how a small number of specific plugins handled an external data feed, not with add-ons as a category. Keeping everything updated and checking for unfamiliar admin accounts periodically is a more realistic habit than avoiding add-ons entirely.

Sourcing note: technical details on the Forminator and BdThemes incidents (CVE numbers, affected versions, and disclosure timelines) are drawn from Wordfence and Defiant security research published in August 2026. Figures like install counts and CVSS scores reflect what was publicly disclosed as of this post's publish date and may be updated as investigations continue.

Hardeep Singh

Hardeep Singh is a tech and money-blogging enthusiast, sharing guides on earning apps, affiliate programs, online business tips, AI tools, SEO, and blogging tutorials. About Author.