Skip to navigation

Threat reportSupply ChainTL-2026-0908

ShapedPlugin WordPress Pro Plugins Backdoored via Build-Pipeline Supply Chain Compromise (CVE-2026-49777, CVE-2026-10735)

criticalACTIVE

Threat actors breached ShapedPlugin's licensed update/distribution pipeline (account.shapedplugin.com on Easy Digital Downloads) during a roughly two-hour window on 21 May 2026 and trojanized Pro builds of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. A LicenseLoader.php stager fires on every admin page load, fetches a second-stage payload, installs it as a hidden fake plugin (woocommerce-subscription / woocommerce-notification), and steals credentials, 2FA secrets, database/SMTP credentials, and WooCommerce payment data.

Key facts

IdentifiersTL-2026-0908, CVE-2026-49777, CVE-2026-10735
Also known asShapedPlugin Supply Chain Attack, ShapedPlugin Build Pipeline Breach
SeverityCRITICAL
CVSS10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
EPSSCVE-2026-49777: 1.6% (73.5th percentile); CVE-2026-10735: 0.1% (9.5th percentile)
Affected productsShapedPlugin, LLC Product Slider Pro for WooCommerce; ShapedPlugin, LLC Real Testimonials Pro; ShapedPlugin, LLC Smart Post Show Pro
Weaknesses (CWE)CWE-1284, CWE-506, CWE-94
Malwarewoocommerce-subscription (fake plugin)
ToolsAdminer 5.2.1, Custom PHP multi-stage backdoor (loader + fake plugin web shell), Tiny File Manager 2.6
MITRE ATT&CK techniquesT1005 Data from Local System, T1036 Masquerading, T1041 Exfiltration Over C2 Channel, T1056 Input Capture, T1059 Command and Scripting Interpreter, T1070 Indicator Removal, T1071 Application Layer Protocol, T1087 Account Discovery, T1105 Ingress Tool Transfer, T1111 Multi-Factor Authentication Interception, T1136 Create Account, T1195 Supply Chain Compromise and 10 more in the attack flow
MotivationFINANCIAL
Target sectorse-commerce, retail, small business, web hosting, publishing
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-06-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0908 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ShapedPlugin Backdoor — C2 Beacon to 194.76.217.28:2871 & TOTP Exfil (C2 / Exfiltration)

Detects the command-and-control and exfiltration legs of the ShapedPlugin backdoor: outbound traffic from a web/PHP host to the C2 at 194.76.217.28 on TCP/2871 (second-stage fetch and exfil over C2 channel) and DNS/HTTP to generate.2faplugin.org (stolen TOTP/2FA secret exfiltration). Either indicator on a WordPress host is high-confidence compromise.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1071, T1105, T1041, T1567, T1111, T1539
  • Data sources: firewall, proxy, dns, edr_network_events, zeek
  • Severity: critical
  • Confidence: high

Splunk SPL

(index=network sourcetype="firewall" dest_ip="194.76.217.28" dest_port=2871)
OR (index=proxy sourcetype="proxy" url="*194.76.217.28:2871*")
OR (index=dns sourcetype="dns" query="*generate.2faplugin.org*")
OR (index=proxy sourcetype="proxy" url="*generate.2faplugin.org*")
| eval indicator=case(dest_ip="194.76.217.28" OR like(url,"%194.76.217.28:2871%"),"c2_beacon_194.76.217.28_2871", like(query,"%generate.2faplugin.org%") OR like(url,"%generate.2faplugin.org%"),"totp_exfil_2faplugin")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by src_ip, dest_ip, dest_port
| sort - count

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "194.76.217.28" and RemotePort == 2871)
    or RemoteUrl has "generate.2faplugin.org"
    or RemoteUrl has "194.76.217.28:2871"
| extend Indicator = iff(RemoteUrl has "generate.2faplugin.org", "totp_exfil_2faplugin", "c2_beacon_194.76.217.28_2871")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort, RemoteUrl, Indicator
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, Indicator
| sort by LastSeen desc

Sigma

title: ShapedPlugin Backdoor C2 Beacon and TOTP Exfiltration
id: 6b9d0c41-2e57-4a88-bf12-0908c3d4e5f6
status: experimental
description: Detects outbound C2 traffic to the ShapedPlugin backdoor server 194.76.217.28:2871 and TOTP/2FA secret exfiltration to generate.2faplugin.org.
references:
    - https://www.wordfence.com/
    - https://thehackernews.com/2026/06/shapedplugin-wordpress-pro-plugins.html
author: Threadlinqs Team
date: 2026/06/22
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1105
    - attack.exfiltration
    - attack.t1041
    - attack.t1567
    - attack.credential_access
    - attack.t1111
    - cve.2026.10735
logsource:
    category: firewall
detection:
    selection_c2:
        dst_ip: '194.76.217.28'
        dst_port: 2871
    selection_totp:
        dst_host|contains: 'generate.2faplugin.org'
    condition: selection_c2 or selection_totp
falsepositives:
    - Threat-intel detonation/sandbox traffic from a controlled environment
level: critical

Known false positives:

  • Authorized malware-sandbox detonation traffic to the IOC infrastructure

Tuning notes: Block and alert on the IOCs at the perimeter/DNS; reduce noise by scoping the source to web/PHP-serving hosts and treat any hit from a WordPress server as a confirmed incident rather than a tunable alert.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ShapedPlugin Loader Execution on wp-admin Load — Process & File Telemetry (Exploitation) · unlock with TL Creds
  • ShapedPlugin Web Shell — REST Route Abuse, Config Theft & Software Discovery (Post-Exploitation) · unlock with TL Creds
  • ShapedPlugin Credential & 2FA Exfiltration Beaconing — Network (C2 / Exfiltration) · unlock with TL Creds
  • ShapedPlugin Trojanized Update Delivery via [indicator] (Exploitation) · unlock with TL Creds
  • ShapedPlugin Hidden Fake Plugin & Rogue Administrator Account (Post-Exploitation) · unlock with TL Creds
  • ShapedPlugin Stolen-TOTP DNS Exfiltration to 2faplugin Domain (C2 / Exfiltration) · unlock with TL Creds
  • ShapedPlugin Trojanized Pro Build — [indicator] Stager Dropped & Self-Deleted (Exploitation) · unlock with TL Creds
  • ShapedPlugin Backdoor — [indicator] Read by Plugin Process & Hidden Fake Plugin (Post-Exploitation) · unlock with TL Creds

Indicators of compromise

As of 2026-06-22, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-0908.

Sample indicators (3 of 18)

  • IP address: 194.76.217[.]28
  • Domain: generate[.]2faplugin[.]org
  • Domain: account[.]shapedplugin[.]com

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

18 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Active exploitation is confirmed across an installation base exceeding 400,000 sites; free WordPress.org versions were unaffected.

Between approximately April and June 2026, attackers compromised the build and distribution pipeline of ShapedPlugin, LLC and injected malicious code into the Pro (paid) releases of multiple widely deployed WordPress plugins. The tampered packages were served through the vendor's official licensed-update channel at account.shapedplugin.com, which runs on Easy Digital Downloads, meaning paying customers received the backdoor through the same trusted mechanism used for legitimate updates. Wordfence telemetry indicates the malicious code was introduced during a narrow two-hour build-pipeline modification window on or about 21 May 2026.

The compromised plugin packages embed a loader, LicenseLoader.php, that executes on every WordPress administrator page load. On first admin access the loader contacts a remote command-and-control server (194.76.217.28 on TCP port 2871), retrieves a second-stage backdoor payload, writes it into wp-content/plugins as a counterfeit plugin (observed slugs woocommerce-subscription and woocommerce-notification), and activates it. The fake plugin hides itself from the WordPress admin plugin list, and the LicenseLoader.php stager self-deletes after installation to erase forensic evidence.

The second-stage backdoor is a multi-capability implant. It hooks WordPress login flows to capture administrator credentials in plaintext (usernames, passwords, active session cookies, user roles, source IP addresses and browser fingerprints) and intercepts two-factor authentication codes/secrets, targeting common 2FA plugins including WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, and the Two-Factor plugin, exfiltrating TOTP secrets to generate.2faplugin.org. It registers custom REST API endpoints that allow arbitrary file writes and command execution (a web shell), and it bundles attacker tooling — Tiny File Manager 2.6 and Adminer 5.2.1 — for hands-on-keyboard file and database access. A persistence/exfiltration script (install-persistent.php) extracts wp-config.php contents (database credentials and WordPress auth/secret keys), enumerates administrator accounts with their registration dates, harvests mail-plugin credentials (WP Mail SMTP, Post SMTP, Easy WP SMTP), and exfiltrates WooCommerce order/payment records from the preceding three months.

The Product Slider Pro for WooCommerce compromise was assigned CVE-2026-49777 (CVSS 10.0); the broader multi-plugin incident is tracked as CVE-2026-10735 (CVSS 9.8). Affected releases include Product Slider for WooCommerce Pro before 3.5.4 (malicious build 3.5.2 observed), Real Testimonials Pro 3.2.5 (malicious build 3.2.4 observed), and Smart Post Show Pro before 4.0.2 (malicious build 4.0.1 observed). ShapedPlugin acknowledged the incident on 16 June 2026 and shipped clean releases: Product Slider Pro 3.5.4, Real Testimonials Pro 3.2.6, and Smart Post Show Pro 4.0.2.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Credential Access

T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1087 Account Discovery; T1518 Software Discovery

Persistence

T1136 Create Account; T1505 Server Software Component; T1554 Compromise Host Software Binary

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Resource Development

T1584 Compromise Infrastructure

Impact

T1657 Financial Theft

Remediation

Patches

  • Product Slider Pro for WooCommerce 3.5.4
  • Real Testimonials Pro 3.2.6
  • Smart Post Show Pro 4.0.2

Immediate actions

  • Identify and update Product Slider Pro for WooCommerce to 3.5.4+, Real Testimonials Pro to 3.2.6+, and Smart Post Show Pro to 4.0.2+
  • Hunt for and remove LicenseLoader.php, install-persistent.php, and the fake plugin directories wp-content/plugins/woocommerce-subscription and wp-content/plugins/woocommerce-notification
  • Block outbound traffic to 194.76.217.28 (TCP/2871) and to generate.2faplugin.org at the perimeter/DNS
  • Treat all administrator credentials, session cookies, and 2FA secrets as compromised: force password resets and re-enroll MFA
  • Rotate wp-config.php database credentials and all WordPress auth/secret keys and salts
  • Rotate SMTP/mail-service credentials for WP Mail SMTP, Post SMTP, and Easy WP SMTP

Workarounds

  • Temporarily deactivate and remove affected ShapedPlugin Pro plugins until clean versions are validated
  • Audit and remove unrecognized administrator accounts created since 21 May 2026

Longer-term hardening

  • Deploy file-integrity monitoring on wp-content/plugins and wp-config.php
  • Restrict and monitor custom REST API route registration and arbitrary file writes
  • Verify plugin update integrity (signatures/checksums) before deployment
  • Deploy a WAF/endpoint solution with behavioral detection for web shells and credential capture

Affected and fixed versions

  • ShapedPlugin, LLC — Product Slider Pro for WooCommerce
    Vulnerable versions: < 3.5.4; 3.5.2
    Fixed in: 3.5.4
  • ShapedPlugin, LLC — Real Testimonials Pro
    Vulnerable versions: 3.2.5; 3.2.4
    Fixed in: 3.2.6
  • ShapedPlugin, LLC — Smart Post Show Pro
    Vulnerable versions: < 4.0.2; 4.0.1
    Fixed in: 4.0.2

Timeline

  • Attackers modified the ShapedPlugin build/distribution pipeline during an approximately two-hour window and injected backdoor code into Pro plugin builds.
  • WPScan / CVE process publishes initial vulnerability records for the affected ShapedPlugin Pro plugins.
  • CVE-2026-49777 (CVSS 10.0) published in NVD for Product Slider Pro for WooCommerce — 'Malicious Software Implanted'.
  • First customer reports of malicious updates delivered through the licensed update channel.
  • Wordfence Threat Intelligence confirms the breach via firewall/telemetry analysis.
  • Malicious plugin builds observed still being distributed as recently as this date.
  • ShapedPlugin acknowledges the incident and announces clean, patched releases pending validation.
  • CVE-2026-49777 record last modified in NVD.
  • Public reporting (The Hacker News and others) details the supply-chain backdoor, IOCs, and patched versions.

Sources cited

Previous and next in supply chain

Further reading

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats