Backdoor RCE Disclosed in WordPress Product Slider Pro for WooCommerce
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jun 5, 2026
A critical vulnerability tracked as CVE-2026-49777 was disclosed in ShapedPlugin's Product Slider Pro for WooCommerce WordPress plugin, with reports describing it as a backdoor and supply-chain remote code execution issue. The flaw was assigned CWE-1284 and a CVSS 3.1 score reflecting critical impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating that attackers could potentially compromise confidentiality, integrity, and availability without authentication or user interaction.
Public reporting shows inconsistent affected-version boundaries, with one source listing versions before 3.5.3 and another identifying versions before 3.5.4, while a Nuclei template pull request labels the issue as KEV and ties it to active detection efforts. The CVE record also notes that the vendor said the issue was fixed in an existing release but did not clearly publish a definitive patched version, leaving defenders to verify plugin versions carefully and treat older deployments as potentially exposed until remediation guidance is clarified.
