[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f67nkF8wBqLaVJOnhVXzhZwnQALFJLLOhcBQQYOHidEA":3},{"article":4,"iocs":43,"watch_terms":59,"solutions":60,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f58fb455-83bb-4783-87b1-8d2e3aa382f4","ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack","shapedplugin-wordpress-pro-plugins-backdoored-in-supply-chain-attack-2ce34d","Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with the official release channels and push backdoor code. \"Attackers compromised the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels,\" Wordfence said in an analysis","Multiple WordPress Pro plugins from ShapedPlugin were compromised in a supply chain attack after threat actors tampered with the vendor's build and distribution pipeline. The backdoored versions of Product Slider Pro, Real Testimonials Pro, and Smart Post Show Pro injected loader code that fetches remote payloads, steals credentials and 2FA codes, establishes persistence, and extracts sensitive data including database credentials and WooCommerce orders. The compromise affected only Pro versions distributed through the vendor's official update channels; free versions remain unaffected.","ShapedPlugin WordPress Pro plugins backdoored via compromised build pipeline.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fshapedplugin-wordpress-pro-plugins.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgd4DchiVkQLBMvGHgWrojoZUdyk2SwEhEj5q6cOYzKCUWF1Lz3Mxeizurg1O-SLVi2jg319ib4SJsSoVWixAkl5WLPu4rL1cMoYXUM6EziOVyt42ESt1zmMo_iLEfHx9XSAXpsDd1FEtRSgKk4AhDzA7DjJN8c__pUgogxTQgaGjsxM04WNiesgRnbEVHN\u002Fs1600\u002Fwordpress-plugin.jpg","2026-06-22T18:00:48+00:00","2026-06-22T20:00:09.118613+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"ShapedPlugin","vendor",{"name":21,"type":22},"Product Slider Pro for WooCommerce","product",{"name":24,"type":22},"Real Testimonials Pro",{"name":26,"type":22},"Smart Post Show Pro",{"name":28,"type":19},"Wordfence",{"name":30,"type":31},"Easy Digital Downloads","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[44,48,52,55],{"type":45,"value":46,"context":47},"ip","194.76.217.28","C2 server receiving loader callback and hosting remote payloads",{"type":49,"value":50,"context":51},"cve","CVE-2026-49777","Product Slider Pro for WooCommerce supply chain compromise, CVSS 10.0",{"type":49,"value":53,"context":54},"CVE-2026-10735","Entire ShapedPlugin incident, CVSS 9.8",{"type":56,"value":57,"context":58},"domain","account.shapedplugin.com","Legitimate vendor EDD infrastructure distributing compromised Pro plugin versions",[18,28,21],{"controls":61,"vendors":140},[62,91,113],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":92,"name":93,"problem":94,"products":95},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},{"slug":114,"name":115,"problem":116,"products":117},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[118,126,132],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":128,"url":130,"description":131},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"shapedplugin-wordpress-pro-plugins-backdoored-via-compromised-build-pipeline","ShapedPlugin WordPress Pro Plugins Backdoored via Compromised Build Pipeline","Threat actors infiltrated ShapedPlugin's build and distribution pipeline, injecting malicious loader code into Pro versions of several WordPress plugins before they reached end users through official update channels. This is a classic supply chain attack where the vendor itself becomes the unwitting delivery mechanism, meaning even security-conscious users who promptly apply updates are exposed. The backdoored plugins exfiltrated highly sensitive data — including database credentials, WooCommerce orders, and 2FA codes — establishing persistent footholds on victim sites. This incident underscores that trusting an official distribution channel is no longer sufficient; organizations must verify the integrity of software at every stage of the supply chain.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST Cybersecurity Framework: ID.SC-4 (Supplier Risk Assessment)","GDPR Article 32: Security of Processing (data exfiltration exposure)","ISO\u002FIEC 27001:2022 A.8.30: Outsourced Development","SLSA Framework: Supply Chain Levels for Software Artifacts",{}]