CVE-2026-10735 concerns multiple WordPress plugins, notably smart-post-show-pro version 4.0.1, which were distributed with malicious code due to a compromised vendor update server. This hidden functionality (CWE-912) enables unauthenticated attackers to deploy a secondary payload that can exfiltrate sensitive information such as credentials and grant full control over the affected WordPress sites. The vulnerability arises from the supply chain compromise rather than a direct flaw in the plugin code itself. No CVSS score or official remediation is currently documented.

The compromise allows attackers to execute unauthorized code on affected WordPress sites, leading to credential theft, data exfiltration, and complete site takeover. This poses a critical risk to site integrity, confidentiality, and availability. Since the malicious code was distributed through the vendor's update server, all sites running the affected versions that applied updates during the compromise window are at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, site administrators should consider removing or disabling the affected plugins (e.g., smart-post-show-pro version 4.0.1) and restoring from backups taken before the compromise. Monitoring for signs of compromise and changing credentials is advisable. Follow vendor communications closely for updates.