CVE-2026-10735: Supply-Chain Attack via Compromised WordPress Plugins — Shapedsmart, Real Testimonials, Product Slider

Technical summary

The vulnerability stems from a compromise of the vendor's update distribution mechanism, resulting in three WordPress plugins being served with embedded malicious code prior to patching. The injected payload functions as a backdoor that establishes persistence and communicates with attacker infrastructure to receive and execute a second-stage payload. This second stage exfiltrates credentials stored in wp-config.php, plugin/theme configuration, browser autofill data, and other sensitive files, then grants the attacker administrative WordPress user access. The attack requires no user interaction beyond the normal plugin update flow—WordPress sites with auto-updates enabled are compromised silently. Affected versions: Shapedsmart-post-show-pro < 4.0.2, Real Testimonials Pro < 3.2.5, Product Slider for WooCommerce Pro < 3.5.3.

Business impact

Organizations running affected plugins face immediate and complete compromise. Beyond the credential theft and site takeover, attackers gain a persistent foothold that enables further attacks: malware distribution to site visitors, payment card theft (critical for e-commerce), ransomware deployment, or lateral movement into internal networks if the WordPress site is integrated with corporate infrastructure. Remediation requires not only patching but also forensic analysis to identify what data was exfiltrated and what additional backdoors may have been planted. For hosting providers and SaaS platforms managing customer sites, this represents a mass-compromise scenario affecting potentially thousands of clients simultaneously.

Affected systems

WordPress sites running Shapedsmart-post-show-pro versions prior to 4.0.2, Real Testimonials Pro versions prior to 3.2.5, or Product Slider for WooCommerce Pro versions prior to 3.5.3. This includes standalone WordPress installations, WooCommerce storefronts, and multisite networks. The risk is heightened for sites with automatic plugin updates enabled, which deploy the malicious code without administrator visibility. Shared hosting environments and managed WordPress platforms are particularly exposed, as a single compromised plugin affects all sites using it.

Exploitability

Exploitability is extraordinarily high. No active attacker reconnaissance, authentication, or user interaction is required; the malicious code is passively distributed through the normal, trusted update mechanism. The payload executes with the same privileges as the WordPress installation, granting full site access. Sites with auto-updates enabled were compromised automatically and silently. Even manually updated sites were at risk if they updated during the window when the compromised versions were hosted. Detection is challenging because the attack leaves no unusual trigger in logs—it appears as a routine plugin installation.

Remediation

Immediately update all three affected plugins to their patched versions (4.0.2 or later for Shapedsmart-post-show-pro, 3.2.5 or later for Real Testimonials Pro, 3.5.3 or later for Product Slider for WooCommerce Pro). After patching, assume compromise and conduct forensic analysis: review WordPress user accounts and admin activity logs for unauthorized access, audit database for injected posts or options, inspect wp-config.php and plugin code for additional backdoors, and check file modification timestamps. Reset all WordPress credentials, database credentials, and any other secrets stored in environment files or the database. Monitor for ongoing command-and-control communication; if feasible, capture and analyze traffic to/from the site during the period the malicious plugin was active to identify exfiltrated data and attacker IP addresses. Notify users if any customer data was exposed.

Patch guidance

Patches are available now: upgrade Shapedsmart-post-show-pro to version 4.0.2 or later, Real Testimonials Pro to 3.2.5 or later, and Product Slider for WooCommerce Pro to 3.5.3 or later. Verify patch downloads directly from the official vendor sources, not from mirrored or third-party repositories. Given the compromise of the update server, consider temporarily disabling automatic plugin updates and manually verifying plugin integrity (via file hash if available from the vendor) before deployment in production environments. After patching, perform the forensic analysis described in the remediation section.

Detection guidance

Search your WordPress plugin manifest for the three affected plugins in any version prior to the patched releases. Use WordPress admin dashboard (Plugins → Installed Plugins) or WP-CLI (wp plugin list) to enumerate versions. If available, review WordPress error and debug logs for any unusual function calls or admin user creation events during the suspected compromise window. Monitor file integrity: check wp-content/plugins/shapedsmart-post-show-pro/, wp-content/plugins/real-testimonials-pro/, and wp-content/plugins/product-slider-for-woocommerce-pro/ for any files with modification timestamps outside normal plugin updates. Inspect the wp_users table for unexpected admin accounts created during the vulnerability window. Query the wp_options table for suspicious hook registrations (wp_cron, shutdown actions, etc.) that may indicate persistence mechanisms. If your hosting provider or security monitoring tool has access to network traffic, search for beacons to unusual domains from the affected sites.

Why prioritize this

This is a Critical priority for any organization running the affected plugins. The vulnerability combines high CVSS score (7.5), zero-day-like accessibility via supply-chain compromise, silent exploitation on auto-updated sites, and full site takeover capability. Unlike traditional vulnerabilities requiring active exploitation, this malicious code was already deployed to hundreds or thousands of sites through the legitimate update channel. The window between initial compromise and patch is the highest-risk period; sites updated during that window are confirmed compromised and require immediate incident response.

Risk score, explained

CVSS 7.5 (High) reflects a network-accessible attack requiring no privileges or user interaction, with high impact on confidentiality (credential exfiltration) but no direct impact on integrity or availability. However, this score understates the practical severity: in context, it is a pre-authenticated backdoor on the victim's system with post-compromise integrity and availability impact (ransomware, malware distribution). The CVSS vector AV:N/AC:L/PR:N/UI:N reflects the ease of exploitation (any site with the plugin is silently compromised), while C:H acknowledges the credential theft. The absence of explicit integrity impact in the base score is because CVSS measures the vulnerability itself (malware in the update package), not the post-compromise attacker capabilities.

Frequently asked questions