# Smart Slider 3 Pro Supply Chain Compromise — Malicious WordPress and Joomla Plugin Updates with Multi-Layered Backdoors (v3.5.1.35)

> Attackers hijacked the Nextend update distribution infrastructure for Smart Slider 3 Pro (900K+ WordPress installations), pushing malicious version 3.5.1.35 on April 7, 2026 containing unauthenticated RCE via crafted HTTP headers, hidden admin account creation, credential exfiltration to wpjs1.com, and four independent persistence mechanisms across mu-plugins, theme functions.php, wp-includes, and cache key files. Both WordPress and Joomla platforms affected.

- **Published:** 2026-04-09T12:00:00Z
- **Last reviewed:** 2026-04-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0342
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-smart-slider-3-pro-backdoor-tl-2026-0342.webp?v=b84b2cd2 (Threadlinqs threat intel: Smart Slider 3 Pro 3.5.1.35 Backdoor: Detection & IOCs (TL-2026-0342) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0342
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (2 shown free below)

## Description

On April 7, 2026, an unauthorized party compromised the update distribution system for Nextend's Smart Slider 3 Pro plugin and pushed malicious version 3.5.1.35 to the official update channel. Any site administrator who clicked 'Update' during the compromise window received a fully backdoored build granting the attacker remote code execution as the web server user.

The malicious version implemented a sophisticated multi-layered attack chain:

**Unauthenticated Remote Code Execution:** The primary backdoor allows a remote attacker to execute operating system commands without any authentication via specially crafted HTTP headers. The _chk query parameter triggers shell execution (shell_exec) or PHP eval from POST data, giving the attacker immediate code execution on any infected site.

**Authenticated Backdoor:** A secondary backdoor provides both PHP eval and OS command execution capabilities, accessible via hidden request parameters (_health_token) embedded in the malicious plugin code.

**Hidden Administrator Account Creation:** The malware automatically creates hidden WordPress administrator accounts with the username prefix wpsvc_ or wp_maint_ and the email address kiziltxt2@gmail.com. These accounts are hidden from the WordPress admin dashboard user list. Credentials are stored in WordPress options (_wpc_uinfo) for persistent access.

**Credential Theft and Exfiltration:** Site information, database credentials, and authentication keys are automatically harvested and exfiltrated to the attacker-controlled domain wpjs1.com.

**Four Independent Persistence Mechanisms:**
1. Must-use plugins (mu-plugins): Files object-cache-helper.php and wp-performance-toolkit.php are installed in wp-content/mu-plugins/. These load automatically on every page request and cannot be disabled from the WordPress dashboard.
2. Theme injection: Backdoor code is injected into the active theme's functions.php, persisting as long as the theme is active.
3. WordPress core masquerading: PHP files class-wp-locale-helper.php and class-wp-locale-textdomain.php are planted in wp-includes/ with names mimicking legitimate WordPress core classes. Authentication is read from .cache_key and .lc_messages files stored in the same directory.
4. Cache/media directory backdoors (Joomla): Files named cf_check.php are placed in /cache and /media directories, providing remote code execution independent of the plugin itself.

The WordPress variant includes deeper persistence mechanisms than the Joomla version, including wp-config.php modifications (WP_CACHE_SALT constant) and .htaccess artifacts (WPCacheSalt comments).

Nextend acknowledged the breach, pulled 3.5.1.35 from distribution, audited their infrastructure, and released clean version 3.5.1.36. However, no post-incident report has been published explaining how the attacker gained access to the update infrastructure or how long they maintained access. Sites that installed version 3.5.1.35 at any point should be treated as fully compromised, requiring complete remediation including backup restoration, credential rotation, and forensic analysis.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1136 Create Account
- T1505 Server Software Component
- T1546 Event Triggered Execution
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1564 Hide Artifacts
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol
- T1102 Web Service
- T1584 Compromise Infrastructure
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Smart Slider 3 Pro — Backdoor File Deployment and Persistence Mechanisms** (`TL-2026-0342-SPL-002`)

Detects the creation of known backdoor files deployed by the malicious Smart Slider 3 Pro v3.5.1.35. The malware installs four independent persistence mechanisms: mu-plugin backdoors (object-cache-helper.php, wp-performance-toolkit.php), wp-includes core masquerading files (class-wp-locale-helper.php, class-wp-locale-textdomain.php), hidden authentication files (.cache_key, .lc_messages), and Joomla cache/media backdoors (cf_check.php). This detection triggers on file creation events matching these specific filenames in their expected directory contexts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1036.005, T1546, T1564.002
- **Data sources:** sysmon, endpoint_detection, file_integrity_monitoring
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*\\mu-plugins\\object-cache-helper.php"
 OR TargetFilename="*\\mu-plugins\\wp-performance-toolkit.php"
 OR TargetFilename="*\\wp-includes\\class-wp-locale-helper.php"
 OR TargetFilename="*\\wp-includes\\class-wp-locale-textdomain.php"
 OR TargetFilename="*\\wp-includes\\.cache_key"
 OR TargetFilename="*\\wp-includes\\.lc_messages"
 OR TargetFilename="*\\cache\\cf_check.php"
 OR TargetFilename="*\\media\\cf_check.php")
| eval persistence_type=case(
    like(TargetFilename, "%mu-plugins%"), "mu-plugin_backdoor",
    like(TargetFilename, "%wp-includes%class-wp-locale%"), "core_masquerading",
    like(TargetFilename, "%wp-includes%.cache_key%") OR like(TargetFilename, "%wp-includes%.lc_messages%"), "hidden_auth_file",
    like(TargetFilename, "%cf_check.php%"), "joomla_backdoor"
)
| stats count AS file_count, values(TargetFilename) AS files_created, values(persistence_type) AS persistence_types, values(Image) AS creating_processes BY ComputerName
| table _time, ComputerName, files_created, persistence_types, creating_processes, file_count
```

### Microsoft KQL

```kql
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where ActionType == "FileCreated"
| where FileName in~ ("object-cache-helper.php", "wp-performance-toolkit.php", "class-wp-locale-helper.php", "class-wp-locale-textdomain.php", ".cache_key", ".lc_messages", "cf_check.php")
| where FolderPath has_any ("mu-plugins", "wp-includes", "cache", "media")
| extend PersistenceType = case(
    FolderPath has "mu-plugins", "mu-plugin_backdoor",
    FolderPath has "wp-includes" and FileName startswith "class-wp-locale", "core_masquerading",
    FolderPath has "wp-includes" and FileName in (".cache_key", ".lc_messages"), "hidden_auth_file",
    FileName == "cf_check.php", "joomla_backdoor",
    "unknown"
)
| summarize FileCount = count(), FilesCreated = make_set(FileName), PersistenceTypes = make_set(PersistenceType) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FilesCreated, PersistenceTypes, FileCount
```

### Sigma

```yaml
title: Smart Slider 3 Pro Backdoor File Creation — Multi-Layer Persistence
id: b8d4f2a1-9e3c-5b7f-c0a2-4d6e8f9b3c15
status: experimental
description: Detects creation of backdoor files associated with the Smart Slider 3 Pro v3.5.1.35 supply chain compromise including mu-plugin backdoors, wp-includes core masquerading files, hidden auth files, and Joomla cache backdoors.
author: Threadlinqs Team
date: 2026/04/09
references:
  - https://smartslider.helpscoutdocs.com/article/2144-wordpress-security-advisory-smart-slider-3-pro-3-5-1-35-compromise
  - https://smartslider.helpscoutdocs.com/article/2143-joomla-security-advisory-smart-slider-3-pro-3-5-1-35-compromise
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1505.003
  - attack.t1036.005
  - attack.t1546
logsource:
  category: file_event
  product: linux
detection:
  selection_mu_plugins:
    TargetFilename|endswith:
      - '/mu-plugins/object-cache-helper.php'
      - '/mu-plugins/wp-performance-toolkit.php'
  selection_core_masquerade:
    TargetFilename|endswith:
      - '/wp-includes/class-wp-locale-helper.php'
      - '/wp-includes/class-wp-locale-textdomain.php'
  selection_hidden_auth:
    TargetFilename|endswith:
      - '/wp-includes/.cache_key'
      - '/wp-includes/.lc_messages'
  selection_joomla:
    TargetFilename|endswith:
      - '/cache/cf_check.php'
      - '/media/cf_check.php'
  condition: 1 of selection_*
falsepositives:
  - Legitimate WordPress performance plugins that create object-cache-helper.php in mu-plugins (verify file hash)
  - Manual WordPress core development or localization work creating files in wp-includes with similar naming
level: critical
```

**Known false positives:**

- Legitimate WordPress caching plugins creating object-cache-helper.php in mu-plugins directory
- Manual WordPress development creating similarly named files in wp-includes

**Tuning notes:** Add file hash allowlists for known legitimate object-cache-helper.php plugins. Correlate with Smart Slider 3 Pro plugin update events to identify backdoor deployment timing. For Linux hosts, adjust Sysmon paths to forward-slash format.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Smart Slider 3 Pro — PHP Backdoor Execution via [indicator] and eval (locked: unlock with TL Creds)
- Smart Slider 3 Pro — Hidden WordPress Admin Account Creation (locked: unlock with TL Creds)
- Smart Slider 3 Pro — WordPress Configuration Tampering and Obfuscated Code Execution (locked: unlock with TL Creds)
- Smart Slider 3 Pro — Malicious Plugin Version 3.5.1.35 File Artifacts (locked: unlock with TL Creds)
- Smart Slider 3 Pro — Theme functions.php Backdoor Injection (locked: unlock with TL Creds)
- Smart Slider 3 Pro — Suspicious wp_options Database Key Indicators of Compromise (locked: unlock with TL Creds)
- Smart Slider 3 Pro — Unauthenticated RCE via Malicious HTTP Parameters (locked: unlock with TL Creds)
- Smart Slider 3 Pro — Credential Exfiltration to [indicator] C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 20)

Defanged, TLP:CLEAR.

- Domain: `wpjs1[.]com`
- Email address: `kiziltxt2[@]gmail[.]com`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BleepingComputer: Smart Slider updates hijacked to push malicious WordPress, Joomla versions](https://www.bleepingcomputer.com/news/security/smart-slider-updates-hijacked-to-push-malicious-wordpress-joomla-versions/)
- [Nextend WordPress Security Advisory: Smart Slider 3 Pro 3.5.1.35 Compromise](https://smartslider.helpscoutdocs.com/article/2144-wordpress-security-advisory-smart-slider-3-pro-3-5-1-35-compromise)
- [Nextend Joomla Security Advisory: Smart Slider 3 3.5.1.35 Compromise](https://smartslider.helpscoutdocs.com/article/2143-joomla-security-advisory-smart-slider-3-pro-3-5-1-35-compromise)
- [WPScan: Smart Slider 3 Pro 3.5.1.35 Compromised Plugin](https://wpscan.com/vulnerability/e1db44ac-5ab9-4245-8f63-3878025c04e2/)
- [mySites.guru: Smart Slider 3 Pro 3.5.1.35 Compromise Analysis](https://mysites.guru/blog/smart-slider-3-pro-supply-chain-compromise/)
- [SC Media: Widespread compromise possible with Smart Slider WordPress plugin flaw](https://www.scworld.com/brief/widespread-compromise-possible-with-smart-slider-wordpress-plugin-flaw)
- [WordPress.org Support Topic: Smart Slider 3 Pro update](https://wordpress.org/support/topic/smart-slider-3-pro-update/)
- [GBHackers: WordPress Plugin Flaw Exposes Sensitive Data from 800,000+ Websites](https://gbhackers.com/wordpress-plugin-flaw-exposes-800000-sites/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0342