ShapedPlugin supply-chain breach infects WordPress plugins

WordPress site administrators using premium plugins from ShapedPlugin were exposed to a supply-chain attack that distributed malware through the vendor’s official update mechanism. The breach affected only paid versions of three plugins, leaving free variants and WordPress.org-hosted releases untouched. ShapedPlugin confirmed the incident after security researchers identified the malicious payloads in customer downloads earlier this month.

What happened

On 21 May 2026, attackers compromised ShapedPlugin’s build pipeline, injecting a malicious loader into three premium plugins: Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. The first reports of suspicious updates appeared on 10 June, when customers noticed unusual behavior after installing recent plugin versions. Security firm Defiant, which operates the Wordfence firewall, confirmed the breach on 12 June after downloading and analyzing infected plugin files from ShapedPlugin’s website.

The malware operated in two stages. When a WordPress administrator logged into an infected site, a hidden loader file (LicenseLoader.php) contacted a command-and-control server, downloaded a second-stage backdoor, and installed it as a fake plugin disguised as a WooCommerce component. The backdoor then erased the loader to avoid detection. Once active, it harvested sensitive data, including WordPress credentials, database access keys, SMTP configurations, and WooCommerce order details from the previous three months. The malware also targeted two-factor authentication secrets from popular security plugins and created rogue administrator accounts.

ShapedPlugin acknowledged the breach on 16 June, stating that it had initiated an investigation and implemented measures to contain the issue. The company released patched versions of the affected plugins—Product Slider Pro 3.5.4, Real Testimonials Pro 3.2.6, and Smart Post Show Pro 4.0.2—though it waited for Wordfence to verify the fixes before notifying customers. The incident is now tracked under CVE-2026-10735, with a duplicate entry filed as CVE-2026-49777.

How the attack unfolded

The attackers gained access to ShapedPlugin’s release infrastructure, allowing them to modify plugin builds before distribution. Unlike a recent breach at OptinMonster—where a misconfigured marketing server exposed CDN credentials—this incident stemmed from a direct compromise of the build pipeline. Evidence includes automated injection patterns, Git build references in the malicious packages, and clean releases on WordPress.org, which uses a separate distribution channel.

The fake plugin installed by the malware remained hidden from the WordPress dashboard, making manual detection difficult. It targeted a broad range of sensitive data, prioritizing credentials that could enable further exploitation, such as persistent access to the site or exfiltration of customer payment details. The attack’s focus on WooCommerce order data suggests a financial motive, though no evidence has emerged linking the breach to specific fraud or ransomware campaigns.

What site owners should do

Administrators who installed updates for the affected plugins between 21 May and 16 June should assume their sites are compromised. Recommended steps include:

• Resetting all WordPress passwords and regenerating authentication keys in wp-config.php
• Reviewing user accounts for unauthorized administrators
• Rotating SMTP and database credentials
• Scanning for the fake plugins (woocommerce-subscription or woocommerce-notification) and removing them
• Updating to the latest patched versions of the affected plugins

ShapedPlugin has not disclosed how the attackers breached its build system, but the incident highlights the risks of supply-chain attacks in the WordPress ecosystem. Even vendors with established security practices can become targets, particularly when attackers exploit automated update mechanisms to distribute malware at scale.