Attackers compromised ShapedPlugin's build and distribution pipeline, injecting backdoor code into Pro plugin updates distributed through official licensed update channels between April and June 2026. The backdoor loader downloads a payload that installs a fake plugin disguised as a WooCommerce-related plugin, hides itself from the admin interface, registers a REST API backdoor allowing arbitrary file writes, bundles file and database management tools, and installs a webshell with command execution capabilities. A hardcoded MD5 hash allows attacker authentication as any administrator without a password. The malware specifically targets two-factor authentication by exfiltrating TOTP seeds to an attacker-controlled domain, enabling bypass of 2FA protections. The compromise was confirmed by Wordfence after obtaining a backdoored plugin from the official update endpoint. The attack is a supply chain compromise affecting at least three Pro plugins: Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. The vendor's free plugins on WordPress.org were not affected. The attack infrastructure is linked to entities tied to Russia. The compromise was automated within a narrow time window, consistent with a CI/CD pipeline breach. The attack demonstrates the evolving threat of supply chain attacks in WordPress ecosystems.

The attack results in full site compromise for affected WordPress sites using ShapedPlugin Pro plugins updated between April and June 2026. Credentials including WordPress admin passwords, database credentials, API keys, and critically, two-factor authentication secrets (TOTP seeds) are stolen and exfiltrated to attacker-controlled infrastructure. This enables attackers to bypass 2FA protections and maintain persistent unauthorized access. The malware also provides attackers with remote file management and database access via bundled tools and webshells. Legitimate update channels were used to distribute the backdoored plugins, meaning site owners following best practices were still compromised. The attack affects hundreds of thousands of websites worldwide using these plugins.

No official vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Affected site owners should immediately scan their WordPress installations for the presence of fake plugins such as 'woocommerce-subscription' or 'woocommerce-notification' under wp-content/plugins/. All WordPress administrator passwords, database credentials, and API keys should be rotated. Critically, all two-factor authentication secrets (TOTP seeds) must be revoked and regenerated for every user, as existing seeds are considered compromised. Site owners should monitor for unusual activity and consider restoring from backups prior to April 2026 if possible. Follow official vendor communications for updates and patches.