shapedplugin

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with the official release channels and push backdoor code. "Attackers compromised the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels," Wordfence said in an analysis published last week. The incident affects the following plugins and versions - Product Slider Pro for WooCommerce 3.5.2 Real Testimonials Pro 3.2.4 and 3.2.5 Smart Post Show Pro 4.0.1 As mentioned above, it's worth emphasizing that the compromise only affects Pro plugin builds distributed through the vendor's Easy Digital Downloads (EDD) infrastructure via account.shapedplugin[.]com. The free versions of the plugins on WordPress.org are not impacted. The supply chain compromise is being tracked as CVE-2026-10735 (CVSS score: 9.8). An earlier identifier, CVE-2026-49777, that was submitted for Product Slider Pro for WooCommerce has been marked as a duplicate. The WordPress security company said the compromised versions of the plugins incorporate a loader that's triggered on every admin page, causing it to fetch a payload from a remote server ("194.76.217[.]28:2871"), install it, and activate it as a fake plugin. Once it's activated, the malware reports the victim domain back to the server and erases itself to cover up the tracks and complicate incident response efforts. The counterfeit plugin, for its part, hides itself from the WordPress admin plugin list and is capable of capturing credentials in plaintext and two-factor authentication (2FA) codes. It also establishes multiple persistence methods that enable arbitrary file writes via a custom REST endpoint when provided a specific authentication token, as well as drop a web shell with command execution features. According to ShapedPlugin's advisories, the malware installs a fake plugin named "WooCommerce Subscription" (not the legitimate WooCommerce Subscriptions extension) and adds a loader to the active theme's functions.php that reads a Base64-encoded payload stored in the "theme_options_scripts" option in the "wp_options" table, writes it to a temporary file, and executes it on every page load. The payload extracts the following data - Full contents of wp-config.php, including database credentials, authentication keys, and debug settings All administrator accounts with registration dates Mail plugin credentials from WP Mail SMTP, Post SMTP, and Easy WP SMTP WooCommerce order data from the last 3 months with payment method breakdown Once this information is displayed in an HTML page, the file is self-deleted. Wordfence assessed the evidence points to a compromise of the build and distribution pipeline rather than direct poisoning of individual packages. ShapedPlugin, however, described the incident as tampering with its Pro builds distributed through the Easy Digital Downloads update channel. What's particularly dangerous about this attack is that it exposes site owners who purchased legitimate licenses and installed updates directly from the vendor's official update system to malware. ShapedPlugin has since released clean versions: Product Slider Pro for WooCommerce 3.5.3, Smart Post Show Pro 4.0.2 (current release 4.0.5), and Real Testimonials Pro 3.2.6. The company also said Real Testimonials Pro 3.2.5 initially shipped clean on May 23, 2026, before its package was tampered with under the same version number. The maintainers replaced it with version 3.2.6 on June 16, 2026. The findings explain why version labels alone are not a reliable indicator of a clean build. Updating an affected plugin installs a clean package but does not remove the second-stage payload if the malware has already run. Both ShapedPlugin and Wordfence advise that sites that run an affected version complete a full cleanup rather than relying on the update alone. Confirming the incident with The Hacker News, ShapedPlugin said it rotated credentials, took the affected distribution infrastructure offline and rebuilt it, discontinued its GitHub-based release workflow pending a hardened redesign, migrated product-file storage to isolated AWS infrastructure, moved its stack to an xCloud-managed VPS with Patchstack monitoring, and proactively notified customers who downloaded an affected build. The Wilmington-based company also emphasized it found no evidence that customer data was accessed, while noting that the data-theft behavior applies to end-user sites that installed a tampered build. Per-product advisories with step-by-step remediation are available for Real Testimonials Pro, Product Slider Pro for WooCommerce, and Smart Post Show Pro. Site owners who have installed the malicious versions are recommended to reset all passwords, revoke and regenerate 2FA secrets for all users, review administrator accounts for unauthorized additions, check for a fake plugin named "WooCommerce Subscription" and loader code in the active theme's "functions.php," and check mail plugin configurations for modified SMTP credentials. (This article was updated after publication on July 7, 2026, with corrected version boundaries for the affected and patched plugins, revised indicators of compromise from ShapedPlugin's official advisories, and an official statement from ShapedPlugin.)

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the vendor's official update system. The malware delivered this way installed a fake plugin that impersonates WooCommerce components, steals credentials, and grants operators remote file-writing capabilities. ShapedPlugin is a WordPress plugin vendor specializing in front-end/UI components and content display plugins, with a total active installation base of more than 400,000 for the free products. The security incident affected only three paid plugins: Product Slider Pro before 3.5.4 for WooCommerce, Real Testimonials Pro 3.2.5, and Smart Post Show Pro before 4.0.2. According to data WordPress security company Defiant collected from its WordFence firewall, the backdoor was injected into ShapedPlugin's Pro builds on May 21, and the first customer reports about potentially malicious updates emerged on June 10. The researchers confirmed the breach after downloading infected plugins from the ShapedPlugin site on June 12, and the publisher acknowledged the incident on June 16. “Our team immediately initiated an investigation upon identifying the concern, and we have already implemented the necessary measures to mitigate the issue,” ShapedPlugin told Wordfence. The publisher added that they were preparing updated plugin releases and validating them before pushing them to the update channels. Supply-chain compromise According to Wordfence’s analysis, the infected plugins contain a malicious loader file (LicenseLoader.php) that activates when a WordPress administrator accesses the website’s admin panel. It contacts the command-and-control (C2) server, downloads the second-stage (backdoor), installs it as a fake plugin (woocommerce-subscription or woocommerce-notification), reports to the attacker, and then self-deletes to erase evidence. The fake plugin, which is hidden from the WordPress plugin list, attempts to steal the following information on infected sites: WordPress login credentials (usernames, passwords, session cookies, user roles, IP addresses, and browser details) Two-factor authentication (2FA) secrets from popular WordPress security plugins Database credentials and WordPress authentication keys from wp-config.php Administrator account details SMTP/email service credentials WooCommerce order data from the past three months, including payment method information The researchers believe this was a build pipeline compromise, based on the file modifications, timestamp patterns suggesting automated injection, and Git build references contained in the packages. Also, releases hosted on WordPress.org were confirmed to be clean, suggesting that the attackers gained access to ShapedPlugin’s release infrastructure. WordPress is currently tracking the incident under CVE-2026-10735, while CVE-2026-49777 was also submitted as a duplicate. The ShapedPlugin compromise comes shortly after another major WordPress product, OptinMonster, was breached in a CDN supply-chain attack possible due to a flaw in a marketing server that allowed the hacker to steal credentials for a CDN account. In the ShapedPlugin case, though, the point of compromise appears to be the build pipeline. BleepingComputer has contacted the plugin vendor for a statement, and the company pointed us to the release of Real Testimonial Pro version 3.2.6, which lists a single fix described as “Fix: Some WPCS-related warnings.” ShapedPlugin also said that an official statement will be published after Wordfence's confirmation that the patches addressed the issue. According to Wordfence, fixes were made available on Product Slider Pro in version 3.5.4 and Smart Post Show Pro in version 4.0.2. If fake WooCommerce plugins are found, website administrators are recommended to reset all passwords on their sites, regenerate two-factor authentication (2FA) secrets, and review user lists for rogue additions. Update 07/07 - A ShapedPlugin spokesperson contacted us to share the below statement: "We confirm the incident. Attackers tampered with Pro builds distributed through our Easy Digital Downloads update channel (account.shapedplugin.com); the free WordPress.org versions were not affected." "The affected Pro products and corrected version boundaries are: Real Testimonials Pro — 3.2.4 and 3.2.5 compromised, 3.2.6 is the clean release; Product Slider Pro for WooCommerce — 3.5.2 compromised, 3.5.3 is the clean release; Smart Post Show Pro — 4.0.1 compromised, 4.0.2 the first clean release (current 4.0.5). Clean, verified versions of all three plugins are now live." "Since discovery we took the affected distribution infrastructure offline and rebuilt it, discontinued our GitHub-based release workflow pending a hardened redesign, migrated product-file storage to isolated AWS infrastructure separate from the site server, moved our stack to an xCloud-managed VPS with Patchstack protection and ongoing monitoring, performed a deep clean, and rotated credentials. On our own systems we have found no evidence that customer data was accessed, and continue to review. The malware's data-theft behavior applies to end-user sites that installed a tampered build; we proactively notified affected customers and are actively helping those who reached out to clean and secure their sites." Full per-product advisories with step-by-step remediation: Real Testimonials Pro: https://docs.shapedplugin.com/security-advisory-real-testimonials-pro-3-2-4-3-2-5-compromise/ Product Slider Pro for WooCommerce: https://docs.shapedplugin.com/woo-product-slider-pro-security-advisory/ Smart Post Show Pro: https://docs.shapedplugin.com/wordpress-security-advisory-smart-post-pro-4-0-1-compromise/ Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report