Attackers breached the build and distribution infrastructure of ShapedPlugin, LLC, a WordPress plugin vendor with more than 400,000 active free-plugin installations. They turned the vendor’s licensed update system into a supply chain security failure that hit paying customers exclusively. The Wordfence Threat Intelligence Team, the WordPress security firm that analyzed the compromise, confirmed three ShapedPlugin Pro products carried the backdoor. Those are Product Slider Pro for WooCommerce (versions before 3.5.4), Real Testimonials Pro 3.2.5, and Smart Post Show Pro (versions before 4.0.2). If your organization runs WordPress sites on any of these plugins and installed updates between May and June 2026, treat those sites as compromised until you have scanned and rotated credentials.
How ShapedPlugin’s Supply Chain Security Failure Reached Paying Customers
ShapedPlugin distributes its free plugins through the WordPress.org repository and its Pro products through an Easy Digital Downloads (EDD) storefront at account.shapedplugin.com. The attackers did not touch WordPress.org; they targeted the commercial EDD channel exclusively, which is why free-plugin users were never exposed. Wordfence concluded this was a CI/CD pipeline compromise rather than simple package tampering. Timestamp analysis of the compromised ZIP shows exactly four files were modified on May 21, 2026 within a two-hour window – consistent with an automated injection step, not manual tampering. Git build artifacts inside the package reference a private ShapedPlugin repository. SVN commit-log analysis shows a committer account change across seven free plugins in April 2026, hinting at earlier unauthorized access to the vendor’s infrastructure.
The malware’s entry point is a loader file, LicenseLoader.php, embedded in the compromised Pro plugin packages. When a WordPress administrator opens the admin panel, the loader contacts a command-and-control (C2) server at 194.76.217.28:2871 and downloads a second-stage payload. It installs as a fake plugin named woocommerce-subscription or woocommerce-notification – singular forms chosen to mimic WooCommerce components while remaining distinct from the legitimate WooCommerce Subscriptions plugin, which uses the plural. The loader then removes itself, erasing the initial infection vector. The installed fake plugin hides from the WordPress admin plugin list via the all_plugins filter, making visual inspection ineffective without a malware scanner.
The CVE assigned to this compromise is CVE-2026-10735 (CVSS 9.8 Critical), with CVE-2026-49777 submitted as a duplicate for the Product Slider Pro vector. First victim infections were observed on May 18, 2026; Wordfence customers with premium malware signatures had detection coverage from April 18 onward.
Why This Supply Chain Attack Bypasses Standard WordPress Security Posture
The operationally important framing here is not that ShapedPlugin was compromised – vendor breaches happen. It is that the malware targeted paying customers specifically, turning security-conscious behavior into the delivery mechanism. Free users, who arguably represent lower-security environments, were protected by their decision to stay on the free tier. Paying users who applied licensed updates promptly – the behavior every security team instructs site owners to follow – were the ones who received the backdoor.
The second-stage payload goes well beyond a simple web shell. Wordfence’s analysis documented seven distinct malicious files inside the fake plugin. They include Tiny File Manager 2.6, Adminer 5.2.1 (a database management interface), a URL parameter webshell, and a REST API backdoor at /wp-json/wc/v3/settings/apply that accepts arbitrary file writes. A separate component uses a hardcoded MD5 hash to allow authentication as any administrator without knowing their password.
The most significant element for organizations running multi-factor authentication (MFA) on WordPress is the two-factor authentication (2FA) secret theft. The credential stealer exfiltrates Time-based One-Time Password (TOTP) seeds from four popular 2FA plugins: WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, and the Two-Factor plugin. Stolen seeds are sent to generate.2faplugin.org, a domain registered to blend with legitimate 2FA traffic. With both the password and the TOTP seed in hand, an attacker can bypass MFA entirely even after a victim resets their WordPress password. Wordfence assessed the C2 infrastructure as registered to AEZA GROUP LLC, a Russian-based entity. This is the supply chain attack vector your current WordPress security posture is least likely to detect before damage is done.
Three Steps to Contain the ShapedPlugin Compromise Before Attackers Pivot Further
Containment here has a specific sequencing problem: the loader self-deletes after first execution, so sites infected weeks ago show no obvious initial infection artifact. Work from the payload side, not the loader side.
Scan for the fake plugin paths and database artifacts – Look for wp-content/plugins/woocommerce-subscription/ or wp-content/plugins/woocommerce-notification/ directories; neither uses the legitimate WooCommerce plural form. Check wp_options for theme_options_scripts and wc_nf_install_done entries, both planted by the backdoor’s persistence layer. Running Wordfence or Wordfence CLI with premium signatures will catch the LicenseLoader.php hash and second-stage components if any copies survive on disk.
Rotate credentials in the order that closes the authentication bypass – Change WordPress admin passwords and database credentials in wp-config.php, then revoke and regenerate all TOTP secrets across every 2FA plugin installed on affected sites. Changing passwords alone leaves attackers with valid MFA seeds; the reverse order does not close the authentication bypass. Review the administrator account list for unauthorized additions, since the REST API backdoor and login bypass hash allow silent account creation.
Extend your supply chain security controls to cover commercial plugin channels – Most organizations apply no equivalent scrutiny to Pro plugins from vendor storefronts that they do to free plugins on WordPress.org. The ShapedPlugin compromise sat undetected for more than three weeks between injection (May 21) and customer reports (June 10) because commercial update channels carry implicit trust. As we covered in our reporting on CI/CD supply chain attacks targeting build pipelines, provenance verification for third-party software is now a front-line requirement. Treat licensed plugin updates with the same file hash checks and malware scanning you apply to other third-party code. Monitor for unexpected new plugin directories; that is exactly what this attack relied on going unnoticed. Site owners who installed ShapedPlugin Pro updates through June 2026 without scanning for these indicators of compromise should assume the attacker’s file management toolset is still running in their WordPress environment.
Join our LinkedIn group Information Security Community!
