BdThemes supply chain attack poisons JSON feed to create rogue WordPress admins and deploy web shells without code changes.