In May 2026, the developers behind ShapedPlugin fell victim to a sophisticated supply chain attack. Attackers breached the vendor’s build infrastructure and slipped a hidden backdoor into the Pro versions of three popular plugins – one capable of stealing login credentials and two-factor authentication codes while hiding itself from site administrators.
How the attack unfolded
ShapedPlugin’s automated build pipeline was compromised around May 21, 2026. Attackers gained access to the Pro-version distribution channel – run through Easy Digital Downloads at account.shapedplugin.com – and injected a malicious loader into the updates. The loader triggered on every WordPress admin page load, fetched a payload from a remote server, and installed it as a fake, hidden plugin that removed itself from the visible plugins list, so administrators had no idea it was there. Security researchers didn’t confirm the compromise until June 11, 2026, after downloading and analyzing packages directly from ShapedPlugin’s distribution servers. The flaw is tracked as CVE-2026-10735 with a CVSS score of 9.8 out of 10 – squarely in critical territory.
Which plugins are affected
Three Pro plugins are impacted: Smart Post Show Pro (compromised in version 4.0.1, fixed in 4.0.2+), Product Slider for WooCommerce Pro (versions before 3.5.4, fixed in 3.5.3/3.5.4+), and Real Testimonials Pro (around version 3.2.4, fixed in 3.2.5+). Crucially, only the paid Pro versions distributed through the vendor’s own store are affected – the free versions on WordPress.org were not touched. ShapedPlugin has more than 400,000 active installs of its free products, so while the exact number of compromised paid sites isn’t public, the potential exposure among paying customers is significant.
What to do if you run these plugins
If your site runs any of the three affected Pro plugins, update to the patched version immediately. Because the backdoor hid itself, don’t rely on the admin plugin list alone – check server files directly. Reset passwords for all administrators and privileged users, re-enroll two-factor authentication, and review your user list for any unfamiliar administrator accounts. If you have a clean backup from before May 21, 2026, consider restoring from it and reinstalling only verified, patched updates afterward.
Why this matters for your website too
The ShapedPlugin incident is far from an isolated case – supply chain attacks on WordPress plugins have been climbing in recent months, since compromising a single plugin vendor is far more efficient for attackers than targeting thousands of individual sites one by one. With WordPress powering roughly two-fifths of all websites, its plugin ecosystem is an enormous and attractive attack surface. Keep your plugin count to the essentials, follow vendor security advisories closely, and consider deploying a web application firewall (WAF) that can flag suspicious behavior before it causes damage.
How to tell if you may have been affected
Beyond updating to the patched version, it’s worth checking for indicators of compromise. Red flags include unusually slow WordPress admin loading, unfamiliar files in plugin directories modified after May 21, 2026, unexpected outbound network connections from the server, or new administrator accounts you didn’t create yourself. If you spot any of these, isolate the site (put it into maintenance mode temporarily), run a full malware scan, and only then restore access and reset passwords.
Not the only security incident this month
ShapedPlugin isn’t the only case that’s kept the security community busy in recent weeks. Alongside it, researchers were also tracking a CDN supply chain attack that hit over a million sites, including the popular OptinMonster plugin, a critical Arbitrary File Upload vulnerability scoring a full 10 out of 10 in the Blocksy Companion plugin, and a separate backdoor campaign targeting the wp-content/mu-plugins folder – a location that standard plugin checks skip entirely. The common thread is the same tactic: attackers target a single vendor or distribution channel and use it to push malicious code to tens or hundreds of thousands of sites at once.
Conclusion
Not sure whether your site was affected, or want peace of mind that your WordPress installation is properly secured? Get in touch – we’re happy to run a security audit and set up protection tailored to your needs. 👇
