Shaped Plugin Word Press Pro Plugins Backdoored in Supply Chain Attack
Summary: Unknown attackers compromised ShapedPlugin's build and distribution pipeline, injecting backdoor code into Pro plugin releases pushed through the vendor's Easy Digital Downloads update channel at account.shapedplugin[.]com; the free WordPress.org versions were not affected. Tracked as CVE-2026-10735 (CVSS 9.8), the loader fires on every admin page, fetches a payload from 194.76.217[.]28:2871, installs it as a fake plugin named "WooCommerce Subscription," reports the victim domain back, then erases itself, while the counterfeit plugin hides from the admin list and captures plaintext credentials and 2FA codes.
Why it matters: Site owners who bought legitimate licenses and updated through the vendor's own system got malware, and updating to a clean build does not remove the second-stage payload if it already ran - Real Testimonials Pro 3.2.5 even shipped clean on May 23, 2026 before being tampered with under the same version number, so version labels prove nothing.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-10735CVE-2026-49777
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026