A supply chain compromise at ShapedPlugin has led to backdoored versions of its premium plugin being delivered through the official update system. Attackers were able to inject backdoor code into the pro versions, potentially allowing unauthorized access to affected sites.
The compromised premium plugins
According to Wordfence, the breach affected Real Testimonials Pro (V3.2.5), Product Slider for WooCommerce (Pro versions before 3.5.4), and Smart Post (Pro versions before 4.0.2). The breach only affects the Pro variants, which are delivered via Easy Digital Downloads (EDD), while free versions available through the WordPress.org plugin repository were not affected.
The free WordPress.org versions of the affected plugins have over 20,000 active installations for Smart Post, over 20,000 for Product Slider, and over 40,000 for Real Testimonials.
Supply chain attacks continue to target WordPress plugins
This incident adds to a growing number of recent supply chain attacks. Earlier, we had reported about how over 80 WPFactory plugins were temporarily closed on WordPress.org, after a user reported a suspected backdoor in one of their premium plugins. It is also worth noting that Easy Digital Downloads is part of the Awesome Motive fleet, which recently saw five of its plugins compromised.
Indicators of a build pipeline breach
Their analysis found several indicators pointing to a possible compromise of ShapedPlugin’s build and release pipeline rather than simple package tampering. According to the report, timestamp analysis of a compromised plugin package showed that only a handful of files were modified during a narrow window, a pattern the researchers said was more consistent with an automated build process injecting the backdoor, “ Only 4 files were modified on May 21st, 2026 within a 2-hour window, consistent with an automated build step that injects the backdoor, not manual tampering.”
They also said the compromised Pro plugin package contained composer metadata referencing a Git commit hash, indicating it was built from a private repository. Wordfence noted that WordPress.org SVN logs showed multiple free plugins being deployed under the ShapedPlugin account with commit messages referencing updates from GitHub, which the company said was consistent with the use of a private build pipeline.
The attackers appeared to selectively target certain Pro plugin builds while leaving free WordPress.org releases untouched, “ The attacker had access to deploy updates to both WordPress.org (free plugins) and the EDD system (Pro plugins), yet chose to only inject malware into some Pro builds.”
Wordfence said this could indicate an effort to avoid malware scanning on WordPress.org, focus on higher-value paying customers, or delay detection by keeping the free plugin releases clean.
The team reached out directly to ShapedPlugin on June 15, 2026. The company acknowledged the report on June 16, stating that it had launched an internal investigation, begun reviewing its build and distribution processes, and implemented measures to mitigate the issue while preparing updated, verified plugin releases.
Credential theft, backdoors, and persistent access
Wordfence’s advisory said the malicious code was designed to operate in multiple stages. According to the report, an initial “loader” component downloaded a secondary payload from an external server, installed it on the target site, reported the victim domain back to a command-and-control server, and then removed itself in an apparent attempt to conceal the infection.
According to Wordfence, the downloaded payload installed itself as a fake plugin named “woocommerce-subscription,” which closely resembled the legitimate WooCommerce Subscriptions plugin. The researchers said they also observed a variation named “woocommerce-notification”.
The report said the fake plugin bundled multiple attack tools, including a REST API backdoor, a login bypass mechanism, credentials, and two-factor authentication (2FA) theft capabilities, and utilities that could provide attackers with file and database access.
Also, the plugin immediately hid itself from the WordPress admin plugin list using the all_plugins filter.
Wordfence said the malware was designed to intercept WordPress authentication activity and collect usernames, passwords, session cookies, IP addresses, and other account information. They said it also searched for time-based one-time password (TOTP) secrets stored by several popular WordPress two-factor authentication plugins, including WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, and the Two-Factor plugin.
The stolen credentials and authentication secrets were transmitted to a domain named “generate.2faplugin.org,” potentially enabling attackers to bypass multi-factor authentication protections, “ With both passwords and TOTP seeds in hand, attackers can bypass multi-factor authentication entirely, even if victims change their passwords after discovering the compromise.”
The report also highlighted how the payload established multiple methods of persistent access, including a custom REST API backdoor, a URL-based webshell, bundled file and database management tools, and a login bypass mechanism that could allow attackers to authenticate as administrator accounts without knowing their passwords
Along with these, the malware could expose sensitive information such as WordPress configuration data, administrator account details, email plugin credentials, and recent WooCommerce order information, while employing anti-forensics techniques including self-deletion, timestamp manipulation, plugin hiding, and code obfuscation to hinder detection and incident response.
Wordfence also identified infrastructure allegedly used in the campaign, including the domain “generate.2faplugin.org,” which they said was used to receive stolen credentials and authentication secrets. They also pointed out that the domain was updated shortly before the suspected backdoor injection period.
Users urged to treat sites as potentially compromised
Wordfence urged users of ShapedPlugin Pro products to immediately scan their sites for signs of compromise, review installed plugins for suspicious variants, rotate credentials, regenerate two-factor authentication secrets, and audit administrator accounts for unauthorized changes.
Site owners who installed ShapedPlugin Pro products during the affected period are advised to treat their websites as potentially compromised and take necessary steps.