Loading vulnerability…
ShapedPlugin Pro WordPress plugins malicious update supply-chain compromise
CVE-2026-10735 tracks a supply-chain compromise affecting multiple premium ShapedPlugin WordPress plugins distributed through the vendor’s official update infrastructure. Affected products include Smart Post Show Pro before 4.0.2, Real Testimonials Pro before 3.2.5, and Product Slider for WooCommerce Pro before 3.5.3/3.5.4 according to the provided reporting. The compromised releases contained malicious code inserted into the vendor’s build or distribution pipeline rather than the public WordPress.org repository. The injected loader, reported as LicenseLoader.php in some analyses, executed on WordPress admin page loads, contacted attacker-controlled infrastructure at 194.76.217.28:2871, downloaded a second-stage payload, installed it as a fake hidden plugin such as woocommerce-subscription or woocommerce-notification, reported the victim back to the attacker, and then self-deleted to reduce forensic visibility. The second stage established persistence and exposed extensive site data, including WordPress credentials, 2FA codes or secrets, wp-config.php contents, administrator account details, SMTP credentials, and WooCommerce order data. Reporting also states the malware enabled arbitrary file writes through a custom REST endpoint and could deploy web-shell-like functionality, resulting in full compromise of affected sites.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in full site compromise. The malicious update chain allows unauthenticated remote attackers to install a persistent second-stage backdoor on affected WordPress sites, steal plaintext credentials, session material, 2FA codes or seeds, database credentials, WordPress authentication keys, administrator account information, SMTP credentials, and WooCommerce business data. The payload also provides persistence, arbitrary file-write capability, hidden plugin installation, and reported command-execution or web-shell deployment capability. In practice, this enables account takeover, data theft, fraudulent administrative access, long-term persistence, follow-on malware deployment, and complete attacker control of the affected WordPress instance.
If you can’t patch tonight, do this now.
Until clean packages are verified and deployed, disable the affected plugins and restrict their update/use. Inspect affected sites for indicators of compromise, especially hidden fake WooCommerce-related plugins, unexpected REST endpoints, arbitrary file-write artifacts, and outbound connections to known attacker infrastructure. Restrict outbound access where operationally feasible, monitor for credential abuse, and review logs for suspicious admin logins and plugin installation events. If compromise is suspected, isolate the site, preserve forensic evidence, and rebuild from a known-good state rather than trusting the existing installation.
Patch, then assume compromise.
Upgrade immediately to known clean versions or later: Smart Post Show Pro 4.0.2+, Real Testimonials Pro 3.2.5+ (some reporting references 3.2.6 as a subsequent validated release), and Product Slider for WooCommerce Pro 3.5.3+ / 3.5.4+ based on the provided sources. Because this was a malicious software distribution incident, patching alone is insufficient. Remove any fake plugins such as woocommerce-subscription or woocommerce-notification, inspect for dropped files including install-persistent.php and any unauthorized file-manager, Adminer, REST endpoint, or web-shell artifacts, and validate plugin files against trusted clean packages. Rotate all WordPress administrator, hosting, database, SMTP, and other secrets present on the site; regenerate WordPress salts and all user 2FA secrets; review administrator accounts and scheduled tasks for unauthorized additions; and perform full incident response to confirm site integrity before returning the system to service.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.