ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
ShapedPlugin WordPress Pro plugins backdoored via compromised build pipeline.
Multiple WordPress Pro plugins from ShapedPlugin were compromised in a supply chain attack after threat actors tampered with the vendor's build and distribution pipeline. The backdoored versions of Product Slider Pro, Real Testimonials Pro, and Smart Post Show Pro injected loader code that fetches remote payloads, steals credentials and 2FA codes, establishes persistence, and extracts sensitive data including database credentials and WooCommerce orders. The compromise affected only Pro versions distributed through the vendor's official update channels; free versions remain unaffected.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ShapedPlugin?
Get an email when a new story names ShapedPlugin, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors infiltrated ShapedPlugin's build and distribution pipeline, injecting malicious loader code into Pro versions of several WordPress plugins before they reached end users through official update channels. This is a classic supply chain attack where the vendor itself becomes the unwitting delivery mechanism, meaning even security-conscious users who promptly apply updates are exposed. The backdoored plugins exfiltrated highly sensitive data — including database credentials, WooCommerce orders, and 2FA codes — establishing persistent footholds on victim sites. This incident underscores that trusting an official distribution channel is no longer sufficient; organizations must verify the integrity of software at every stage of the supply chain.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 194.76.217.28
- cve — CVE-2026-49777
- cve — CVE-2026-10735
- domain — account.shapedplugin.com