Trojanized Smart Slider 3 Pro Update Delivered Backdoor Through Nextend Servers
Summary
Nextend and Patchstack reported that attackers used a compromised update system to distribute Smart Slider 3 Pro v3.5.1.35, which enabled remote access, persistence and credential exfiltration. Nextend removed it and advised cleanup and an upgrade.
Key points
- Nextend said unauthorized access to its update system was used to distribute malicious Smart Slider 3 Pro v3.5.1.35 for about six hours beginning April 7, 2026.
- Patchstack reported that the backdoor enabled pre-authentication remote code execution through HTTP headers and hidden request parameters.
- The malware could create concealed administrator accounts and establish persistence in a must-use plugin, the active theme’s functions.php, and wp-includes.
- The article reports that the backdoor sent credentials and site and system details to the C2 domain wpjs1[.]com.
- Nextend removed the malicious build and shut down its update servers during its investigation; the article says the free plugin version was not affected.
- Users with v3.5.1.35 installed were advised to upgrade to v3.5.1.36, remove backdoor persistence, reset credentials, and review sites and logs for unauthorized activity.
Article Details
- Victim Organization
- Nextend
- Victim Domain
- Unknown
- Incident Type
- Supply-chain compromise of Nextend’s update infrastructure to distribute a trojanized Smart Slider 3 Pro update.
- Incident Date
- 2026-04-07
- Data Types Exposed
- Administrator usernames and passwords
- Administrator email addresses
- WordPress database name
- Backdoor authentication key
- Site and server metadata, including hostname, site URL, and software versions
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The malicious Smart Slider 3 Pro v3.5.1.35 update was available through Nextend’s official update channel for approximately six hours. Sites that installed it could be exposed to pre-authentication remote code execution, hidden administrator accounts, persistent backdoors, and credential exfiltration. Nextend removed the update and advised affected users to update and clean their sites.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | wpjs1[.]com | C2 domain identified by Patchstack as the destination for exfiltrated credentials and site metadata. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe backdoor exfiltrated credentials and site metadata to a C2 domain.T1195.002 · Compromise Software Supply ChainThe attacker accessed Nextend’s update infrastructure and distributed a trojanized plugin build through the official update channel.T1505.003 · Web ShellThe malicious update installed persistent PHP backdoor components in WordPress files.
Vendors
Products
Smart Slider 3 ProUnknown actors hijacked Nextend’s update infrastructure to push a trojanized Smart Slider 3 Pro v3.5.1.35 that delivered a multi-stage backdoor through the official update channel.WordPressUnknown threat actors have hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla to push a poisoned version containing a backdoor.