# ShapedPlugin WordPress Pro Plugins Backdoored via Build-Pipeline Supply Chain Compromise (CVE-2026-49777, CVE-2026-10735)

> Threat actors breached ShapedPlugin's licensed update/distribution pipeline (account.shapedplugin.com on Easy Digital Downloads) during a roughly two-hour window on 21 May 2026 and trojanized Pro builds of Product Slider Pro for WooCommerce, Real Testimonials Pro, and Smart Post Show Pro. A LicenseLoader.php stager fires on every admin page load, fetches a second-stage payload, installs it as a hidden fake plugin (woocommerce-subscription / woocommerce-notification), and steals credentials, 2FA secrets, database/SMTP credentials, and WooCommerce payment data. Active exploitation is confirmed across an installation base exceeding 400,000 sites; free WordPress.org versions were unaffected.

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0908
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-shapedplugin-pro-build-breach-tl-2026-0908.webp?v=75d529ff (Threadlinqs threat intel: ShapedPlugin Pro Build Pipeline Breach: Detection & IOCs (TL-2026-0908) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-0908
- **Severity:** CRITICAL (CVSS 10)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)
- **CVEs:** CVE-2026-49777, CVE-2026-10735

## Description

Between approximately April and June 2026, attackers compromised the build and distribution pipeline of ShapedPlugin, LLC and injected malicious code into the Pro (paid) releases of multiple widely deployed WordPress plugins. The tampered packages were served through the vendor's official licensed-update channel at account.shapedplugin.com, which runs on Easy Digital Downloads, meaning paying customers received the backdoor through the same trusted mechanism used for legitimate updates. Wordfence telemetry indicates the malicious code was introduced during a narrow two-hour build-pipeline modification window on or about 21 May 2026.

The compromised plugin packages embed a loader, LicenseLoader.php, that executes on every WordPress administrator page load. On first admin access the loader contacts a remote command-and-control server (194.76.217.28 on TCP port 2871), retrieves a second-stage backdoor payload, writes it into wp-content/plugins as a counterfeit plugin (observed slugs woocommerce-subscription and woocommerce-notification), and activates it. The fake plugin hides itself from the WordPress admin plugin list, and the LicenseLoader.php stager self-deletes after installation to erase forensic evidence.

The second-stage backdoor is a multi-capability implant. It hooks WordPress login flows to capture administrator credentials in plaintext (usernames, passwords, active session cookies, user roles, source IP addresses and browser fingerprints) and intercepts two-factor authentication codes/secrets, targeting common 2FA plugins including WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, and the Two-Factor plugin, exfiltrating TOTP secrets to generate.2faplugin.org. It registers custom REST API endpoints that allow arbitrary file writes and command execution (a web shell), and it bundles attacker tooling — Tiny File Manager 2.6 and Adminer 5.2.1 — for hands-on-keyboard file and database access. A persistence/exfiltration script (install-persistent.php) extracts wp-config.php contents (database credentials and WordPress auth/secret keys), enumerates administrator accounts with their registration dates, harvests mail-plugin credentials (WP Mail SMTP, Post SMTP, Easy WP SMTP), and exfiltrates WooCommerce order/payment records from the preceding three months.

The Product Slider Pro for WooCommerce compromise was assigned CVE-2026-49777 (CVSS 10.0); the broader multi-plugin incident is tracked as CVE-2026-10735 (CVSS 9.8). Affected releases include Product Slider for WooCommerce Pro before 3.5.4 (malicious build 3.5.2 observed), Real Testimonials Pro 3.2.5 (malicious build 3.2.4 observed), and Smart Post Show Pro before 4.0.2 (malicious build 4.0.1 observed). ShapedPlugin acknowledged the incident on 16 June 2026 and shipped clean releases: Product Slider Pro 3.5.4, Real Testimonials Pro 3.2.6, and Smart Post Show Pro 4.0.2.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1584 Compromise Infrastructure
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1554 Compromise Host Software Binary
- T1036 Masquerading
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1056 Input Capture
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1518 Software Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ShapedPlugin Backdoor — C2 Beacon to 194.76.217.28:2871 & TOTP Exfil (C2 / Exfiltration)** (`TL-2026-0908-SPL-003`)

Detects the command-and-control and exfiltration legs of the ShapedPlugin backdoor: outbound traffic from a web/PHP host to the C2 at 194.76.217.28 on TCP/2871 (second-stage fetch and exfil over C2 channel) and DNS/HTTP to generate.2faplugin.org (stolen TOTP/2FA secret exfiltration). Either indicator on a WordPress host is high-confidence compromise.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071, T1105, T1041, T1567, T1111, T1539
- **Data sources:** firewall, proxy, dns, edr_network_events, zeek
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=network sourcetype="firewall" dest_ip="194.76.217.28" dest_port=2871)
OR (index=proxy sourcetype="proxy" url="*194.76.217.28:2871*")
OR (index=dns sourcetype="dns" query="*generate.2faplugin.org*")
OR (index=proxy sourcetype="proxy" url="*generate.2faplugin.org*")
| eval indicator=case(dest_ip="194.76.217.28" OR like(url,"%194.76.217.28:2871%"),"c2_beacon_194.76.217.28_2871", like(query,"%generate.2faplugin.org%") OR like(url,"%generate.2faplugin.org%"),"totp_exfil_2faplugin")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by src_ip, dest_ip, dest_port
| sort - count
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemoteIP == "194.76.217.28" and RemotePort == 2871)
    or RemoteUrl has "generate.2faplugin.org"
    or RemoteUrl has "194.76.217.28:2871"
| extend Indicator = iff(RemoteUrl has "generate.2faplugin.org", "totp_exfil_2faplugin", "c2_beacon_194.76.217.28_2871")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort, RemoteUrl, Indicator
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, Indicator
| sort by LastSeen desc
```

### Sigma

```yaml
title: ShapedPlugin Backdoor C2 Beacon and TOTP Exfiltration
id: 6b9d0c41-2e57-4a88-bf12-0908c3d4e5f6
status: experimental
description: Detects outbound C2 traffic to the ShapedPlugin backdoor server 194.76.217.28:2871 and TOTP/2FA secret exfiltration to generate.2faplugin.org.
references:
    - https://www.wordfence.com/
    - https://thehackernews.com/2026/06/shapedplugin-wordpress-pro-plugins.html
author: Threadlinqs Team
date: 2026/06/22
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1105
    - attack.exfiltration
    - attack.t1041
    - attack.t1567
    - attack.credential_access
    - attack.t1111
    - cve.2026.10735
logsource:
    category: firewall
detection:
    selection_c2:
        dst_ip: '194.76.217.28'
        dst_port: 2871
    selection_totp:
        dst_host|contains: 'generate.2faplugin.org'
    condition: selection_c2 or selection_totp
falsepositives:
    - Threat-intel detonation/sandbox traffic from a controlled environment
level: critical
```

**Known false positives:**

- Authorized malware-sandbox detonation traffic to the IOC infrastructure

**Tuning notes:** Block and alert on the IOCs at the perimeter/DNS; reduce noise by scoping the source to web/PHP-serving hosts and treat any hit from a WordPress server as a confirmed incident rather than a tunable alert.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ShapedPlugin Loader Execution on wp-admin Load — Process & File Telemetry (Exploitation) (locked: unlock with TL Creds)
- ShapedPlugin Web Shell — REST Route Abuse, Config Theft & Software Discovery (Post-Exploitation) (locked: unlock with TL Creds)
- ShapedPlugin Credential & 2FA Exfiltration Beaconing — Network (C2 / Exfiltration) (locked: unlock with TL Creds)
- ShapedPlugin Trojanized Update Delivery via [indicator] (Exploitation) (locked: unlock with TL Creds)
- ShapedPlugin Hidden Fake Plugin & Rogue Administrator Account (Post-Exploitation) (locked: unlock with TL Creds)
- ShapedPlugin Stolen-TOTP DNS Exfiltration to 2faplugin Domain (C2 / Exfiltration) (locked: unlock with TL Creds)
- ShapedPlugin Trojanized Pro Build — [indicator] Stager Dropped & Self-Deleted (Exploitation) (locked: unlock with TL Creds)
- ShapedPlugin Backdoor — [indicator] Read by Plugin Process & Hidden Fake Plugin (Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `194.76.217[.]28`
- Domain: `generate[.]2faplugin[.]org`
- Domain: `account[.]shapedplugin[.]com`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack](https://thehackernews.com/2026/06/shapedplugin-wordpress-pro-plugins.html)
- [ShapedPlugin update flow hacked to infect WordPress sites](https://www.bleepingcomputer.com/news/security/shapedplugin-update-flow-hacked-to-infect-wordpress-sites/)
- [ShapedPlugin Supply Chain Attack: WordPress Pro Plugins Backdoored](https://www.ctrlaltnod.com/news/shapedplugin-supply-chain-attack-backdoors-wordpress-pro-plugins/)
- [Supply-chain attack injects backdoor on ShapedPlugin WordPress software](https://cyberinsider.com/supply-chain-attack-injects-backdoor-on-shapedplugin-wordpress-software/)
- [ShapedPlugin Build Pipeline Breach Delivers Credential-Stealing Backdoor to 400,000+ WordPress Sites](https://news.shield53.com/shapedplugin-build-pipeline-breach-delivers-credential-stealing-backdoor-to-400000-wordpress-sites/)
- [NVD - CVE-2026-49777](https://nvd.nist.gov/vuln/detail/CVE-2026-49777)
- [Supply Chain Attack Compromises Multiple ShapedPlugin WordPress Plugins](https://cirt.gov.jm/advisory/supply-chain-attack-compromises-multiple-shapedplugin-wordpress-plugins)
- [Backdoored ShapedPlugin Pro Updates Exposed WordPress Sites to Full Takeover](https://www.mallory.ai/stories/019ed184-ee94-7d70-8aa1-d32b2e0290f6)
- [Wordfence Threat Intelligence](https://www.wordfence.com/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0908