ShapedPlugin Pro Updates Backdoored in Supply-Chain Attack
Summary
ShapedPlugin confirmed an incident involving its Pro-plugin releases. Malicious updates delivered a hidden backdoor capable of stealing credentials and collecting site data. Three plugins were affected; site owners were urged to reset passwords and 2FA secrets.
Key points
- Attackers tampered with official licensed updates for ShapedPlugin’s Pro plugins; the free versions were not affected.
- Affected products and versions: Product Slider Pro for WooCommerce before 3.5.4, Real Testimonials Pro 3.2.5, and Smart Post Show Pro before 4.0.2.
- A loader fetched a payload from 194.76.217[.]28:2871, installed a hidden fake plugin, and reported the victim domain to the server.
- The backdoor could capture plaintext credentials and 2FA codes, write arbitrary files through a custom REST endpoint, and deploy a web shell with command execution.
- A bundled PHP file could collect wp-config.php contents, administrator account details, mail-plugin credentials, and three months of WooCommerce order data.
- The incident is associated with CVE-2026-49777 (CVSS 10.0) and CVE-2026-10735 (CVSS 9.8).
- Affected site owners were advised to reset passwords, regenerate 2FA secrets, check administrator accounts, and review SMTP settings.
Article Details
- Victim Organization
- ShapedPlugin's release pipeline; customer WordPress sites running affected plugins
- Incident Type
- Supply-chain compromise involving backdoored Pro plugin releases distributed through ShapedPlugin's official update channels
- Data Types Exposed
- Database credentials, authentication keys, and debug settings from wp-config.php
- Administrator account details and registration dates
- Mail plugin credentials
- WooCommerce order data from the previous three months, including payment method breakdowns
- Plaintext credentials and two-factor authentication codes
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Affected plugin versions could install a hidden fake plugin, capture credentials and 2FA codes, establish persistence, write arbitrary files, and provide web shell command execution. The article does not quantify the number of affected sites or confirm how many had data taken.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 194[.]76[.]217[.]28 | Remote server from which the compromised plugin loader fetched the payload; the malware also reported victim domains to this server. |
MITRE ATT&CK
CVE
Vendors
Products
Easy Digital DownloadsAs mentioned above, it’s worth emphasizing that the compromise only affects Pro plugin builds distributed through the vendor’s Easy Digital Downloads (EDD) infrastructure via account.shapedplugin[.]com.Product Slider Pro for WooCommercerelease pipeline was compromised, allowing attackers to push backdoored Pro versions of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro through legitimate update channels.Real Testimonials Proallowing attackers to push backdoored Pro versions of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro through legitimate update channels.Smart Post Show Proto push backdoored Pro versions of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro through legitimate update channels.WooCommercepipeline was compromised, allowing attackers to push backdoored Pro versions of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro through legitimate update channels.WordPressMultiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with the official release channels and push backdoor code.