WordPress under attack by ShapedPlugin's Pro plugin supply chain and back doors and credentials theft

The recent intrusion that affected several plugins Pro of the developer ShapedPlugin illustrates with crudely the risk most feared by the WordPress community: a commitment of the supply chain that installs back doors in legitimate facilities through official updating channels. According to public reports, unknown actors managed to manipulate the process of construction and distribution of versions Pro delivered by the supplier's Easy Digital Download system, so that malicious packages reach buyers with valid licenses and are activated from site management.

The technical consequences described by the researchers include a active loader on administration pages you download and activate a false plugin, which allows you to report the domain to the attacking server, capture credentials and 2FA codes in flat text, create REST endpoints with authentication token for arbitrary file writing and deploy a web shell. It has also documented the use of a file called "install-persistent.php" to extract extremely sensitive data - such as the full content of wp-config.php (including database credentials and authentication keys), administrative account data, mail plugin credentials and recent WooCommerce orders - and then self-destroy that trail. These behaviors make the intrusion highly destructive and difficult to detect if not acted quickly.

There are two immediate lessons from the operational point of view: first, the threat came from the supplier's distribution channel, not from the free repository of WordPress.org; the free versions would not be affected; second, the compromise signals can disappear after exfiltration (deleted files, hidden plugins), so the response should combine containment actions with forensic reviews. It is proven that one of the problems was the commitment of the seller's building / distribution process, a classic weakness in models where trust is in unsigned binary artifacts.

If you manage sites with Product Slider Pro for WooCommerce (versions before 3.5.4), Real Testimonials Pro (3.2.5) or Smart Post Show Pro (before 4.0.2), consider that the reported exposures include CVE-2026-49777 (maximum severity CVSS 10.0) and a joint classification CVE-2026-10735. Act as if the server and credentials were compromised: revokes and breaks passwords and secrets (including database, FTP / SFTP accounts, API keys and SMTP credentials), requires the regeneration of 2FA tokens for all users, reviews and eliminates unknown administrators and explores access records and errors in search of unusual downloads or requests to PIs or remote ports.

In addition to immediate measures, further research is essential if you detect signs: inspection of the wp-content / plugins directory to identify folders or foreign files (e.g. files with atypical names or the mentioned "install-persistent.php"), search for web shells, analysis of cron jobs and programmed tasks, verification of file integrity against reliable backups and restoration from a prior copy known as clean when appropriate. If you do not have sufficient forensic evidence, work with your host or an incident response team: manual file removal without a plan can destroy evidence necessary to understand the actual scope.

In preventive and long-term terms, site owners and suppliers must demand more robust practices from distributors: device signatures, reproducible buildings and supply chain audits such as those promoted by SLSA-type initiatives or OWASP projects on software chain integrity. Implement file integrity monitoring, restrict administrative account privileges, minimize the number of plugins with access to sensitive data and apply the principle of minor privilege in site credentials reduces the attack surface. Practical resources for hardening facilities and understanding defensive controls are available in official WordPress documentation and in community security initiatives; for example, review hardening guides in https: / / wordpress.org / support / article / hardening-wordpress / and materials on chain integrity in https: / / slsa.dev /.

If you acquired the Pro versions concerned, keep in touch with the supplier and the official security channels that report on patches and validated versions; ShapedPlugin has confirmed the investigation and is reviewing its processes, but it is key not to apply updates until there are signed and audited buildings. Meanwhile, it blocks suspicious outgoing connections from your servers to directions indicated in the reports and considers applying web firewall rules or a WAF to limit the exposure of REST endpoints.

Finally, it takes this intrusion as a reminder to separate the supply of critical plugins from automated operations without verification: it avoids the automatic installation of plugins from private sources without a validation process, retains immutable backup outside the affected server and requires suppliers to transparency on their build-up pipelines and signature mechanisms. For tracking and news related to threats to WordPress and plugins, you can see reputable sources such as the Wordfence blog in https: / / www.wordfence.com / blog / and the official notices of the supplier; acting quickly and method is the best defense when the trust in the supply chain is compromised.