Supply chain attack hit ShapedPlugin's build pipeline and pushed backdoored Pro plugin updates to 400K+ WordPress sites. Malware stole admin creds and 2FA secrets, then dropped a web shell, REST API backdoor, and Tiny File Manager for persistent access. CVE-2026-10735.
Post summary
The text reports active exploitation of CVE-2026-10735 via a supply‑chain attack that deployed backdoored WordPress plugin updates to more than 400,000 sites, but it provides no PoC, patch information, or technical details.
A ShapedPlugin supply chain attack (CVE-2026-10735) injected malware into WordPress Pro plugins. Discover the impact and how to protect your site today.
#CyberSecurity#WordPress#Malware#ShapedPlugin#SupplyChainAttack
https://securityonline.info/shapedplugin-supply-chain-attack https://t.co/zQREXTjP0d
Post summary
The tweet alerts about a supply chain attack involving CVE-2026-10735 that injected malware into WordPress Pro plugins, but it offers no technical details, PoC, or mitigation specifics.
Active supply chain compromise: Attackers infiltrated ShapedPlugin's build and distribution pipeline, injecting a multi-stage backdoor into Pro WordPress plugin releases delivered through official licensed update channels. CVE-2026-10735 (CVSS 9.8 Critical) affects Product Slider Pro, Real Testimonials Pro, and Smart Post Show Pro. Sites that installed any ShapedPlugin Pro product between April and June 2026 should be treated as compromised.
Key technical details:
- Stage 1 loader: `src/Includes/LicenseLoader.php` runs on `admin_init`, beacons to C2 at `194[.]76[.]217[.]28:2871`, downloads payload via WordPress Plugin_Upgrader, then self-deletes to cover tracks (T1027, T1070.004)
- Stage 2 fake plugin drops to `wp-content/plugins/woocommerce-subscription/` (singular, not plural), hiding itself from the admin plugin list via `all_plugins` filter. Bundles Tiny File Manager 2.6, Adminer 5.2.1, a REST API backdoor at `/wp-json/wc/v3/settings/apply`, a URL parameter webshell, and a login bypass using hardcoded MD5 `e268c35a06d85f672e70c9beecb4e5d1`
- 2FA secret exfiltration targets TOTP seeds from WP 2FA, Wordfence Login Security, Really Simple SSL, and Two-Factor plugin user meta. Stolen data exfils to `generate[.]2faplugin[.]org`. With both passwords and TOTP seeds compromised, MFA is fully bypassed even after password resets
#DFIR_Radar
Post summary
Attackers infiltrated ShapedPlugin’s build pipeline, inserted a multi‑stage backdoor exploiting CVE‑2026‑10735 across several WordPress plugins, and sites installed during April‑June 2026 are considered compromised with comprehensive exploitation details supplied.
🚨 HIGH - Supply-chain backdoor in WordPress plugin updates (CVE-2026-10735)
Multiple WordPress plugins (smart-post-show-pro, Real Testimonials Pro, and Product Slider for WooCommerce Pro) were distributed with malicious code after the vendor update server was compromised, resulting in backdoored plugin updates being delivered to sites. The root cause is a supply-chain compromise of the update distribution mechanism, enabling unauthorized code injection into otherwise legitimate plugin releases. Attackers exploit this by simply waiting for sites to check for and install the poisoned updates, requiring no authentication and leveraging normal WordPress update workflows. If installed, the backdoor can fetch a second-stage payload to exfiltrate credentials and sensitive data and potentially hand attackers full administrative control of affected WordPress sites.
👉 Affected: smart-post-show-pro < 4.0.2; Real Testimonials Pro < 3.2.5; Product Slider for WooCommerce Pro < 3.5.3 | Upgrade to smart-post-show-pro 4.0.2, Real Testimonials Pro 3.2.5, Product Slider for WooCommerce Pro 3.5.3
Post summary
A supply‑chain backdoor in WordPress plugin updates (CVE‑2026‑10735) has been disclosed; attackers inject malicious code via the compromised update server, and users are urged to upgrade to the latest plugin versions to mitigate the risk.
Attackers compromised ShapedPlugin's update infrastructure to distribute backdoored WordPress Pro plugins (CVE-2026-10735, CVE-2026-49777). The malware established C2 communications and exfiltrated credentials from affected sites. This incident highlights risks in trusted update channels. #SupplyChainSecurity
:link: Full TRC analysis: https://aviatrix.ai/threat-research-center/shapedplugin-wordpress-pro-plugins-backdoored-in-supply-chain-attack
Post summary
The tweet announces a supply‑chain compromise involving ShapedPlugin’s update mechanism, with attackers deploying backdoored WordPress plugins, but it lacks detailed technical or mitigation information.
