ShapedPlugin WordPress Pro supply-chain backdoor (build/EDD pipeline compromise)

cve · CVE-2026-10735

Coverage timeline

first 2026-06-23 → last 2026-06-29

Peak priority

high

2 high

Sources cited

3 hosts

Sections touched

active-threats, weekly-top-stories

Co-occurring entities

no co-occurrence

ATT&CK techniques

pinned v19.1 · see below

Hunting pivots

ATT&CK techniques

3 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-06-23/shapedplugin-build-pipeline-compromised-three-pro-wordpress · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-06-23/shapedplugin-build-pipeline-compromised-three-pro-wordpress · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-06-23/shapedplugin-build-pipeline-compromised-three-pro-wordpress · ATT&CK page ↗

Story timeline

2026-06-29ShapedPlugin's official update channel shipped backdoored WordPress Pro plugins — credential, 2FA-secret and web-shell theft
weekly-top-stories
2026-06-23ShapedPlugin build pipeline compromised — three Pro WordPress plugins backdoored to steal credentials, 2FA secrets and drop a web shell
active-threats

Where this entity is cited

active-threats1
weekly-top-stories1

Source distribution

bleepingcomputer.com1 (33%)
thehackernews.com1 (33%)
wordfence.com1 (33%)

explore in graph

External references

NVD · cve.org · CISA KEV

All cited sources (3)

Entries about ShapedPlugin WordPress Pro supply-chain backdoor (build/EDD pipeline compromise) (2)

2026-06-29 · view entry permalink →

HIGHCVE-2026-10735exploited

ShapedPlugin's official update channel shipped backdoored WordPress Pro plugins — credential, 2FA-secret and web-shell theft

If you did nothing this week: any site running the ShapedPlugin Pro plugins that auto-updated through the licensed channel pulled backdoor code straight from the vendor — patch level was no defence, because the trusted distribution pipeline itself was the attacker. The malicious LicenseLoader.php loads inside the WordPress admin panel, fetches a second stage, installs it as a fake plugin and self-deletes to frustrate forensics.

Wordfence disclosed on 2026-06-22 that an attacker breached ShapedPlugin's build and Easy Digital Downloads distribution pipeline and injected backdoor code into the Pro (paid) releases of three plugins, served through official update channels. The implant harvests credentials and 2FA secrets and drops a web shell (BleepingComputer). For a public-sector or education estate that runs WordPress behind a CMS team, the hunt is for the fake-plugin artefact and unexpected LicenseLoader.php execution in the admin context, plus credential/2FA rotation for any admin who logged in during the exposure window — not merely "update the plugin." (daily 06-23)

Attackers compromised the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels

Wordfence

The malicious packages contained a file named LicenseLoader.php, which was loaded automatically within the WordPress admin panel ... downloaded a second-stage payload, installed it as a fake plugin ... and then deleted itself to hinder forensic analysis

BleepingComputer

synthesis29 Jun 00:20Zmulti-sourceOpen finding ↗

Sources: Wordfence · BleepingComputer

2026-06-23 · view entry permalink →

HIGHCVE-2026-10735exploited

ShapedPlugin build pipeline compromised — three Pro WordPress plugins backdoored to steal credentials, 2FA secrets and drop a web shell

Wordfence disclosed on 2026-06-22 that an attacker breached the build and Easy Digital Downloads (EDD) distribution pipeline of plugin vendor ShapedPlugin and injected backdoor code into the Pro (paid) releases of three products — Product Slider Pro for WooCommerce (before 3.5.4), Real Testimonials Pro (fixed in 3.2.5) and Smart Post Show Pro (before 4.0.2) — tracked as CVE-2026-10735 (Wordfence, 2026-06-22; BleepingComputer, 2026-06-22). The free versions hosted on the WordPress.org repository were not affected — only the licensed Pro updates pushed through EDD between roughly 21 May and 12–16 June carried the injection. The malicious code planted a LicenseLoader.php stub that executes when an administrator loads any wp-admin page; it calls out to a C2, downloads a second-stage payload, installs it as a hidden fake plugin (masquerading as woocommerce-subscription / woocommerce-notification), reports the victim domain, then deletes itself to frustrate forensics (The Hacker News, 2026-06-22). The second stage steals WordPress admin credentials, 2FA TOTP secrets, wp-config.php salts and database credentials, and maintains persistence through hidden REST API endpoints. Timestamp analysis pointed to an automated injection touching only four files inside a two-hour window — consistent with a pipeline-level compromise rather than manual tampering.

Why it matters to us: This is the "trusted update channel" supply-chain pattern again (cf. the W25 OptinMonster strand), and the operational consequence is that patching is not remediation — Wordfence's guidance is to treat any site that installed an affected Pro update as fully compromised. Detection concepts (no IOCs): hunt for a LicenseLoader.php in plugin directories; for installed plugins named woocommerce-subscription / woocommerce-notification that do not appear in the admin plugin list; for php-fpm/apache2/nginx child processes making outbound connections (Sysmon EID 1 with a web-server parent image, or auditd execve on PHP workers); and for wp_users rows with administrator role created after ~21 May. Mapped to T1195.002 Compromise Software Supply Chain, T1505.003 Server Software Component: Web Shell, T1552.001 Unsecured Credentials: Credentials In Files. Remediation: update to the fixed Pro versions, then rotate all WordPress secrets — admin passwords, 2FA, DB credentials and wp-config.php salts — and review the WooCommerce order/SMTP-credential exposure.

Attackers compromised the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels

Wordfence

BleepingComputer

incident23 Jun 04:52Zmulti-sourceOpen finding ↗

Sources: Wordfence · BleepingComputer · The Hacker News