Smart Slider 3 Pro Supply Chain Compromise — Malicious WordPress and Joomla Plugin Updates with Multi-Layered Backdoors (v3.5.1.35)
Smart Slider 3 Pro Supply Chain Compromise (TL-2026-0342), also tracked as Smart Slider 3 Pro Supply Chain Attack, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-04-09. It has no confirmed attribution, affects Nextend Smart Slider 3 Pro (WordPress), maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0342
- Threat ID
- TL-2026-0342
- Also known as
- Smart Slider 3 Pro Supply Chain Attack, Nextend Update Infrastructure Compromise
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-09
- Last reviewed
- 2026-04-09
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, e-commerce, media, education, small-business, healthcare, government, non-profit
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Attackers hijacked the Nextend update distribution infrastructure for Smart Slider 3 Pro (900K+ WordPress installations), pushing malicious version 3.5.1.35 on April 7, 2026 containing unauthenticated RCE via crafted HTTP headers, hidden admin account creation, credential exfiltration to wpjs1.com, and four independent persistence mechanisms across mu-plugins, theme functions.php, wp-includes, and cache key files. Both WordPress and Joomla platforms affected.
How Smart Slider 3 Pro Supply Chain Compromise works
On April 7, 2026, an unauthorized party compromised the update distribution system for Nextend's Smart Slider 3 Pro plugin and pushed malicious version 3.5.1.35 to the official update channel. Any site administrator who clicked 'Update' during the compromise window received a fully backdoored build granting the attacker remote code execution as the web server user.
The malicious version implemented a sophisticated multi-layered attack chain:
**Unauthenticated Remote Code Execution:** The primary backdoor allows a remote attacker to execute operating system commands without any authentication via specially crafted HTTP headers. The _chk query parameter triggers shell execution (shell_exec) or PHP eval from POST data, giving the attacker immediate code execution on any infected site.
**Authenticated Backdoor:** A secondary backdoor provides both PHP eval and OS command execution capabilities, accessible via hidden request parameters (_health_token) embedded in the malicious plugin code.
**Hidden Administrator Account Creation:** The malware automatically creates hidden WordPress administrator accounts with the username prefix wpsvc_ or wp_maint_ and the email address kiziltxt2@gmail.com. These accounts are hidden from the WordPress admin dashboard user list. Credentials are stored in WordPress options (_wpc_uinfo) for persistent access.
**Credential Theft and Exfiltration:** Site information, database credentials, and authentication keys are automatically harvested and exfiltrated to the attacker-controlled domain wpjs1.com.
**Four Independent Persistence Mechanisms:** 1. Must-use plugins (mu-plugins): Files object-cache-helper.php and wp-performance-toolkit.php are installed in wp-content/mu-plugins/. These load automatically on every page request and cannot be disabled from the WordPress dashboard. 2. Theme injection: Backdoor code is injected into the active theme's functions.php, persisting as long as the theme is active. 3. WordPress core masquerading: PHP files class-wp-locale-helper.php and class-wp-locale-textdomain.php are planted in wp-includes/ with names mimicking legitimate WordPress core classes. Authentication is read from .cache_key and .lc_messages files stored in the same directory. 4. Cache/media directory backdoors (Joomla): Files named cf_check.php are placed in /cache and /media directories, providing remote code execution independent of the plugin itself.
The WordPress variant includes deeper persistence mechanisms than the Joomla version, including wp-config.php modifications (WP_CACHE_SALT constant) and .htaccess artifacts (WPCacheSalt comments).
Nextend acknowledged the breach, pulled 3.5.1.35 from distribution, audited their infrastructure, and released clean version 3.5.1.36. However, no post-incident report has been published explaining how the attacker gained access to the update infrastructure or how long they maintained access. Sites that installed version 3.5.1.35 at any point should be treated as fully compromised, requiring complete remediation including backup restoration, credential rotation, and forensic analysis.
MITRE ATT&CK techniques used in TL-2026-0342
collection
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1078 Valid Accounts; T1564 Hide Artifacts
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service
persistence
T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component
initial-access
impact
credential-access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials
privilege-escalation
T1546 Event Triggered Execution
resource-development
Affected products and versions in Smart Slider 3 Pro Supply Chain Compromise
- Nextend — Smart Slider 3 Pro (WordPress)
Vulnerable versions: 3.5.1.35
Fixed in: 3.5.1.36 - Nextend — Smart Slider 3 Pro (Joomla)
Vulnerable versions: 3.5.1.35
Fixed in: 3.5.1.36
Remediation for Smart Slider 3 Pro Supply Chain Compromise
Patches
- Update Smart Slider 3 Pro to version 3.5.1.36 (clean release)
- Run Nextend official cleanup script after manual remediation
Immediate actions
- Determine if Smart Slider 3 Pro version 3.5.1.35 was installed — check plugin version history and update logs
- If compromised, immediately enable maintenance mode and take the site offline
- Restore from a backup created on or before April 5, 2026
- Block the domain wpjs1.com at the network perimeter and DNS level
- Search for and remove hidden admin accounts with wpsvc_ or wp_maint_ username prefixes
- Remove the email kiziltxt2@gmail.com from all user accounts
- Delete backdoor files: wp-content/mu-plugins/object-cache-helper.php, wp-content/mu-plugins/wp-performance-toolkit.php, wp-includes/class-wp-locale-helper.php, wp-includes/class-wp-locale-textdomain.php, wp-includes/.cache_key, wp-includes/.lc_messages
- For Joomla: delete /cache/cf_check.php and /media/cf_check.php
- Remove malicious WordPress options: _wpc_ak, _wpc_uid, _wpc_uinfo, _perf_toolkit_source
- Clean .htaccess of WPCacheSalt entries and wp-config.php of WP_CACHE_SALT constant
Workarounds
- If backup restoration is not possible, perform complete manual cleanup of all backdoor files, database entries, and rogue accounts as detailed in vendor advisory
- Block outbound connections to wpjs1.com to prevent ongoing credential exfiltration
- Temporarily disable Smart Slider 3 Pro until version 3.5.1.36 is verified clean
Longer-term hardening
- Rotate all credentials: WordPress admin, database, FTP/SSH, hosting panel, and API keys
- Regenerate WordPress security salts and authentication keys
- Reinstall WordPress core files from trusted source to ensure no core file tampering
- Reinstall all plugins and themes from verified sources
- Deploy web application firewall with rules to detect shell_exec, eval(base64_decode patterns
- Implement file integrity monitoring for wp-includes/, mu-plugins/, and theme directories
- Enable two-factor authentication for all admin accounts
- Disable PHP execution in wp-content/uploads/ directory
- Review and audit WordPress plugin update procedures — consider staged rollouts
- Monitor access logs for _chk and _health_token parameter usage
Weaknesses (CWE) in Smart Slider 3 Pro Supply Chain Compromise
CWE-506, CWE-912
Timeline of Smart Slider 3 Pro Supply Chain Compromise
- Dmitrii Ignatyev discovers CVE-2026-3098 (arbitrary file read in Smart Slider 3 <= 3.5.1.33) via Wordfence Bug Bounty Program, reported to Nextend
- CVE-2026-3098 publicly disclosed — Smart Slider 3 arbitrary file download vulnerability affecting 500K+ sites
- Last known safe backup point before malicious update distribution — recommended restoration date accounting for timezone differences
- WPScan adds Smart Slider 3 Pro 3.5.1.35 to compromised plugin database (WPVDB ID: e1db44ac-5ab9-4245-8f63-3878025c04e2)
- Attacker pushes malicious Smart Slider 3 Pro version 3.5.1.35 through hijacked Nextend update distribution infrastructure; sites auto-updating or manually updating receive backdoored build
- Nextend pulls malicious version 3.5.1.35 from distribution, begins infrastructure audit
- BleepingComputer publishes detailed analysis of the supply chain compromise; multiple security vendors issue advisories; widespread media coverage begins
- Nextend releases clean version 3.5.1.36 and publishes security advisories for both WordPress and Joomla platforms with detailed cleanup instructions
- As of 2026-05-29, the malicious Smart Slider 3 Pro 3.5.1.35 build was pulled within ~6 hours and clean 3.5.1.36 is the current release, so the supply-chain delivery vector is contained. It remains a live concern: backdoors persist on sites that installed 3.5.1.35 (updating does not remove them), the wpjs1.com C2 has no confirmed takedown, and the actor is unattributed with no post-incident report.
Sources cited for Smart Slider 3 Pro Supply Chain Compromise
- BleepingComputer: Smart Slider updates hijacked to push malicious WordPress, Joomla versions
- Nextend WordPress Security Advisory: Smart Slider 3 Pro 3.5.1.35 Compromise
- Nextend Joomla Security Advisory: Smart Slider 3 3.5.1.35 Compromise
- WPScan: Smart Slider 3 Pro 3.5.1.35 Compromised Plugin
- mySites.guru: Smart Slider 3 Pro 3.5.1.35 Compromise Analysis
- SC Media: Widespread compromise possible with Smart Slider WordPress plugin flaw
- WordPress.org Support Topic: Smart Slider 3 Pro update
- GBHackers: WordPress Plugin Flaw Exposes Sensitive Data from 800,000+ Websites
Threats related to Smart Slider 3 Pro Supply Chain Compromise
Detection coverage for TL-2026-0342
As of 2026-04-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0342 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.