vendor-distribution-compromisebuild-pipeline-compromiseinternet-facing-service-vulnerabilitywidely-deployed-product-advisory

Backdoored ShapedPlugin Pro Updates Exposed WordPress Sites to Full Takeover

Supply Chain Risk · 5 sources · Updated 5mo ago · First seen Jun 16, 2026

A supply-chain compromise of ShapedPlugin’s premium WordPress plugin distribution inserted backdoor code into official paid releases, allowing unauthenticated attackers to fully compromise affected websites. Wordfence said the attackers tampered with the vendor’s update pipeline used for Pro builds distributed via Easy Digital Downloads, while free versions in the WordPress repository were not affected. Confirmed malicious releases included Smart Post Show Pro 4.0.1, Product Slider for WooCommerce Pro 3.5.2, and Real Testimonials Pro 3.2.4, which were later replaced by clean versions 4.0.2, 3.5.3, and 3.2.5; the incident is tracked as CVE-2026-10735 with a reported CVSS 9.8.

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Apr 13, 2026 – Jun 16, 2026

Jun 16, 20265mo ago
ShapedPlugin acknowledges plugin supply-chain incident
ShapedPlugin acknowledged the compromise affecting its paid WordPress plugin update flow on June 16, 2026. The acknowledgment followed reports of malicious updates distributed through the vendor’s official system and came after infected downloads had been confirmed.
ShapedPlugin update flow hacked to infect WordPress sites
Jun 11, 20265mo ago
ShapedPlugin premium plugin supply-chain compromise discovered
Wordfence disclosed that a supply-chain compromise affecting ShapedPlugin premium WordPress plugins was discovered on June 11, 2026. Attackers tampered with the vendor’s distribution pipeline and inserted backdoor code into official paid releases, while free repository versions were reportedly unaffected.
ShapedPlugin Supply Chain Attack: CVE-2026-10735 Alert
Jun 3, 20265mo ago
CVE-2026-10735 publicly published
The supply-chain backdoor issue affecting multiple ShapedPlugin Pro plugins was publicly published as CVE-2026-10735. The report described malicious plugin builds that enabled full site compromise and identified associated command-and-control and dropper infrastructure.
ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server | CVE 2026-10735 | Plugin Vulnerabilities
May 21, 20266mo ago
Forensics identify likely CI/CD compromise window
Wordfence reported forensic evidence that the ShapedPlugin intrusion likely involved a CI/CD pipeline compromise, with only four files modified within a two-hour window on May 21, 2026. Package metadata also indicated the malicious builds came from a private repository rather than the normal release process.
ShapedPlugin Supply Chain Attack Backdoors Pro Plugin Updates
Apr 13, 20267mo ago
Clean plugin versions released to replace malicious builds
Affected malicious ShapedPlugin Pro releases were later replaced with clean versions: Smart Post Show Pro 4.0.2, Product Slider for WooCommerce Pro 3.5.3, and Real Testimonials Pro 3.2.5. The compromised versions identified were 4.0.1, 3.5.2, and 3.2.4 respectively.
ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server | CVE 2026-10735 | Plugin Vulnerabilities

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

ShapedPlugin Pro WordPress plugins malicious update supply-chain compromise (CVE-2026-10735)

Affected products

5 linked

WordpressWordpressProduct Slider ProReal-Testimonials-ProSmart-Post-Show-Pro

Organizations

1 linked

Shapedplugin

Breaches

1 linked

SHAPEDPLUGIN-2026-05

Observables

5 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Security AffairsNews · Jun 23, 2026

ShapedPlugin Supply Chain Attack Backdoors Pro Plugin UpdatesOpen source ↗

The Hacker NewsNews · Jun 22, 2026

ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain AttackOpen source ↗

Bleeping ComputerNews · Jun 18, 2026

ShapedPlugin update flow hacked to infect WordPress sitesOpen source ↗

Security Online InfoNews · Jun 16, 2026

ShapedPlugin Supply Chain Attack: CVE-2026-10735 AlertOpen source ↗

Wpscan VulnNews · Apr 13, 2026

ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server | CVE 2026-10735 | Plugin VulnerabilitiesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

vendor-distribution-compromisebuild-pipeline-compromiseinternet-facing-service-vulnerabilitywidely-deployed-product-advisory

Backdoored ShapedPlugin Pro Updates Exposed WordPress Sites to Full Takeover

Supply Chain Risk · 5 sources · Updated 5mo ago · First seen Jun 16, 2026

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Apr 13, 2026 – Jun 16, 2026

Jun 16, 20265mo ago
ShapedPlugin acknowledges plugin supply-chain incident
ShapedPlugin acknowledged the compromise affecting its paid WordPress plugin update flow on June 16, 2026. The acknowledgment followed reports of malicious updates distributed through the vendor’s official system and came after infected downloads had been confirmed.
ShapedPlugin update flow hacked to infect WordPress sites
Jun 11, 20265mo ago
ShapedPlugin premium plugin supply-chain compromise discovered
Wordfence disclosed that a supply-chain compromise affecting ShapedPlugin premium WordPress plugins was discovered on June 11, 2026. Attackers tampered with the vendor’s distribution pipeline and inserted backdoor code into official paid releases, while free repository versions were reportedly unaffected.
ShapedPlugin Supply Chain Attack: CVE-2026-10735 Alert
Jun 3, 20265mo ago
CVE-2026-10735 publicly published
The supply-chain backdoor issue affecting multiple ShapedPlugin Pro plugins was publicly published as CVE-2026-10735. The report described malicious plugin builds that enabled full site compromise and identified associated command-and-control and dropper infrastructure.
ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server | CVE 2026-10735 | Plugin Vulnerabilities
May 21, 20266mo ago
Forensics identify likely CI/CD compromise window
Wordfence reported forensic evidence that the ShapedPlugin intrusion likely involved a CI/CD pipeline compromise, with only four files modified within a two-hour window on May 21, 2026. Package metadata also indicated the malicious builds came from a private repository rather than the normal release process.
ShapedPlugin Supply Chain Attack Backdoors Pro Plugin Updates
Apr 13, 20267mo ago
Clean plugin versions released to replace malicious builds
Affected malicious ShapedPlugin Pro releases were later replaced with clean versions: Smart Post Show Pro 4.0.2, Product Slider for WooCommerce Pro 3.5.3, and Real Testimonials Pro 3.2.5. The compromised versions identified were 4.0.1, 3.5.2, and 3.2.4 respectively.
ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server | CVE 2026-10735 | Plugin Vulnerabilities

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →