Hijacked Smart Slider 3 Pro Update Delivered Backdoors to WordPress and Joomla Sites
Summary
A malicious Smart Slider 3 Pro v3.5.1.35 update distributed April 7 may have affected WordPress and Joomla sites, installing backdoors and stealing credentials. The vendor recommends restoring a pre-April 7 backup or updating to v3.5.1.36 and cleaning affected sites.
Key points
- The vendor says attackers hijacked the update system and distributed malicious Smart Slider 3 Pro version 3.5.1.35 on April 7; some sites may have installed it.
- PatchStack reports the toolkit can execute commands through crafted HTTP headers without authentication and includes a second authenticated backdoor with PHP eval, OS command execution, and credential theft.
- Persistence mechanisms include a hidden administrator account, a must-use plugin, modifications to the active theme’s functions.php, and a backdoor in wp-includes.
- The wp-includes backdoor reads its authentication key from a separate .cache_key file, so changing database credentials alone does not remove it.
- The vendor warns that affected Joomla installations may also receive hidden administrator accounts and backdoors in the /cache and /media directories.
- Administrators are advised to restore a backup from April 5 or earlier, or install version 3.5.1.36, then remove malicious components, reinstall trusted files, rotate credentials, and scan for remaining malware.
Article Details
- Event Type
- Software supply-chain compromise involving a hijacked plugin update system
- Impact
- A malicious Smart Slider 3 Pro version, 3.5.1.35, was distributed on April 7. It could install multiple persistent backdoors, create a hidden administrator account, enable remote command execution, and steal site credentials and information. The vendor said some sites may have installed the version; the article does not confirm how many were affected. Smart Slider 3 is used on over 900,000 WordPress sites, indicating potential reach. The vendor recommends updating to version 3.5.1.36 or restoring a clean backup from April 5 or earlier, followed by full cleanup and credential rotation.
Products
Joomlamu-plugins, theme and core file implants, and a database-independent loader—so affected WordPress and Joomla sites should restore a clean backup or immediately update to 3.5.1.36 and follow full cleanup procedures.Smart Slider 3 ProAttackers hijacked the update system for Smart Slider 3 Pro and pushed a malicious version (3.5.1.35) that installed multiple backdoors, created a hidden administrator account, and exfiltrated site credentials.WordPressmu-plugins, theme and core file implants, and a database-independent loader—so affected WordPress and Joomla sites should restore a clean backup or immediately update to 3.5.1.36 and follow full cleanup