CVE-2026-49777Disclosure

HIGHCVSS 10.0 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

Back to dashboard

6.0/ 10 priority

Sources & remediation

Other references

https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability?_s_id=cve

Weakness type (CWE)

CWE-1284

Priority

HIGH

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
6 mentions across 4 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 2 classified signals
Peaked 3d ago at 2 mentions (2026-06-05); latest day: 1
6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

233.3%

Patch

233.3%

Active Exploitation

233.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	2	Disclosure1Patch1
2026-06-11	1	Disclosure1
2026-06-22	2	Active Exploitation2
2026-07-30	1	Patch1

Full discourse6 posts

pdnuclei-bot@pdnuclei_bot130d
Disclosure
🚨 CVE-2026-49777 - critical 🚨 WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE > Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-49777 @pdnuclei #N...
Post summary
CVE-2026-49777 is disclosed as a critical supply‑chain backdoor RCE affecting WordPress Product Slider Pro for WooCommerce versions below 3.5.4, with no evidence of active exploitation or an available patch provided in the text.
00011156
958 followersView on X
CyberAlertsHQ@CyberAlertsHQ119d
Active Exploitation
🚨 NEW: ShapedPlugin's build and distribution pipeline was compromised. Attackers injected backdoors into three Pro plugins (Product Slider Pro, Real Testimonials Pro, Smart Post Show Pro) pushed via the official Easy Digital Downloads update channel. CVE-2026-49777 (CVSS 10.0). The loader triggers on every admin page, fetches a remote payload, installs it as a fake plugin that hides itself. It steals wp-config.php (database credentials, auth keys), admin accounts, SMTP plugin creds from WP Mail SMTP/Post SMTP/Easy WP SMTP, and 3 months of WooCommerce orders with payment breakdown. Then it deletes itself to erase forensics. Full breakdown 👇 https://thehackernews.com/2026/06/shapedplugin-wordpress-pro-plugins.html
Post summary
CVE-2026-49777 is being actively exploited through backdoors inserted into ShapedPlugin Pro extensions, where attackers deploy a malicious loader that steals credentials and order data before deleting itself to evade detection.
1000083
83 followersView on X
DFIR Lab@DFIR_Lab82d
Patch
🚨 CRITICAL: CVE-2026-49777 (CVSS 10.0) affects Product Slider Pro for WooCommerce <3.5.4. Allows remote malware implantation via improper input validation. Update immediately. #CVE #PatchNow #ThreatIntel https://t.co/Kmxkkpn7gl
Post summary
The tweet warns of a critical CVE-2026-49777 in Product Slider Pro for WooCommerce that permits remote malware installation, and urges users to update immediately.
0000043
98 followersView on X
Aviatrix Threat Research Center@aviatrixtrc119d
Active Exploitation
Attackers compromised ShapedPlugin's update infrastructure to distribute backdoored WordPress Pro plugins (CVE-2026-10735, CVE-2026-49777). The malware established C2 communications and exfiltrated credentials from affected sites. This incident highlights risks in trusted update channels. #SupplyChainSecurity :link: Full TRC analysis: https://aviatrix.ai/threat-research-center/shapedplugin-wordpress-pro-plugins-backdoored-in-supply-chain-attack
Post summary
Attackers exploited ShapedPlugin’s update mechanism to deliver backdoored WordPress Pro plugins, establishing C2 channels and exfiltrating credentials, underscoring active supply‑chain attacks.
0000064
1.9K followersView on X
SecAlerts@SecAlertsCo136d
Disclosure
CVSS 10 backdoor in WordPress. CVE-2026-49777 hits Product Slider Pro for WooCommerce &lt; 3.5.3, allowing malicious software implants with no auth required. If you run WooCommerce, check your plugins now. https://secalerts.co/vulnerability/CVE-2026-49777 https://t.co/ax1Y29Kack
Post summary
A new high‑severity backdoor CVE-2026‑49777 affecting Product Slider Pro for WooCommerce versions below 3.5.3 has been disclosed, with no authentication required and no evidence of active exploitation or patches reported.
0000060
830 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨Critical - Product Slider Pro for WooCommerce Backdoor (CVE-2026-49777) A backdoor was implanted in version 3.5.2 of the Product Slider Pro for WooCommerce WordPress plugin by ShapedPlugin LLC. The malicious code allows unauthenticated remote attackers to execute arbitrary commands and gain full control over affected WordPress sites. The vendor applied a silent fix under the same version number (3.5.2), meaning sites cannot reliably determine whether they are running the compromised or patched build. 👉Affected: Product Slider Pro for WooCommerce < 3.5.3
Post summary
The post announces a silent patch for a backdoor vulnerability (CVE‑2026‑49777) in Product Slider Pro for WooCommerce 3.5.2 that permits unauthenticated remote command execution, urging users to verify their version.
0000065
207 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-49777

CyberAlertsHQ[verified]@CyberAlertsHQActive Exploitation

CVE-2026-49777 is being actively exploited through backdoors inserted into ShapedPlugin Pro extensions, where attackers deploy a malicious loader that steals credentials and order data before deleting itself to evade detection.

DFIR Lab[verified]@DFIR_LabPatch

The tweet warns of a critical CVE-2026-49777 in Product Slider Pro for WooCommerce that permits remote malware installation, and urges users to update immediately.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

Attackers exploited ShapedPlugin’s update mechanism to deliver backdoored WordPress Pro plugins, establishing C2 channels and exfiltrating credentials, underscoring active supply‑chain attacks.

Upwind Security MDR[verified]@UpwindMDRPatch

The post announces a silent patch for a backdoor vulnerability (CVE‑2026‑49777) in Product Slider Pro for WooCommerce 3.5.2 that permits unauthenticated remote command execution, urging users to verify their version.

pdnuclei-bot@pdnuclei_botDisclosure

CVE-2026-49777 is disclosed as a critical supply‑chain backdoor RCE affecting WordPress Product Slider Pro for WooCommerce versions below 3.5.4, with no evidence of active exploitation or an available patch provided in the text.

SecAlerts@SecAlertsCoDisclosure

A new high‑severity backdoor CVE-2026‑49777 affecting Product Slider Pro for WooCommerce versions below 3.5.3 has been disclosed, with no authentication required and no evidence of active exploitation or patches reported.