ShapedPlugin Pro Update Channel Hijacked, Customers Backdoored

Here's an awkward one for the WordPress ecosystem. ShapedPlugin, a commercial plugin vendor, had its build and distribution pipeline compromised. The people who got caught out were the ones doing everything by the book: paying for licences and pulling updates directly from the official source.

A Wordfence analysis published last week found that attackers had slipped backdoor code into Pro plugin releases shipped through ShapedPlugin's Easy Digital Downloads infrastructure at account.shapedplugin.com. The free versions hosted on WordPress.org are clean. The compromise affecting Product Slider Pro for WooCommerce has been tagged CVE-2026-49777 with a perfect CVSS score of 10.0. The broader incident is tracked as CVE-2026-10735 at 9.8.

How the backdoor works

The mechanics are unpleasant. A loader fires on every admin page load, pulls a payload from 194.76.217.28 on port 2871, installs it as a counterfeit plugin, then deletes itself to muddy the forensic trail. The fake plugin then settles in and does the dirty work:

• Hides itself from the plugin list inside the admin UI
• Harvests usernames, passwords and 2FA codes in plaintext as users log in
• Drops a web shell for ongoing access
• Registers a custom REST endpoint that allows arbitrary file writes when called with the right token

There's also a bundled PHP file that quietly exfiltrates site data before erasing itself. Subtle, in the sense that none of it appears in the obvious places an admin would look.

What ShapedPlugin is saying

The vendor has acknowledged the incident and says it is reviewing how releases are built and shipped. New versions are due once the security validation is complete. There's no detail yet on how the build environment was breached or how long the malicious releases were in circulation before someone noticed.

If you run the affected Pro plugins

Anyone who installed one of the compromised Pro builds should treat the site as breached. That means more than just updating when a clean release lands. The credentials and tokens that were exposed are already in someone else's hands.

• Reset every password on the affected site, including admin, FTP, hosting and database
• Regenerate 2FA secrets for every account, since the seeds may have been captured
• Audit administrator accounts for anything unexpected, and remove unfamiliar users
• Check SMTP credentials in any mail-related plugins for tampering, since those are a common pivot point for outbound spam and onward phishing
• Look for unfamiliar plugins, particularly ones that do not appear in the admin list but exist on disk

The uncomfortable bit

This was not a dodgy nulled plugin from a forum no one should be browsing. It was the official update channel, working exactly as designed, delivering compromised code to customers who had paid for the privilege of trusting the vendor.

Supply chain risk doesn't stop at your own perimeter. Every legitimate vendor in the stack is another point where someone else's bad day becomes yours.