Security Breach Exposes Backdoors in ShapedPlugin Paid Plugins via Supply Chain Attack

Key Takeaways

• Attackers compromised ShapedPlugin’s commercial update channel, injecting a backdoor into three Pro plugins (Product Slider Pro, Real Testimonials Pro, Smart Post Show Pro) between May 21 and June 10 2026.
• Only paying customers who applied licensed updates were affected; free‑plugin users remained safe because the WordPress.org repository was untouched.
• The malware uses a self‑deleting loader (LicenseLoader.php) that contacts C2 194.76.217.28:2871, installs a fake plugin (woocommerce‑subscription or woocommerce‑notification), and then removes itself.
• The second‑stage payload includes a file manager, database tool, REST API backdoor, URL‑parameter webshell, and a credential stealer that extracts TOTP seeds from major 2FA plugins, enabling full MFA bypass.
• Detection requires scanning for the fake plugin directories, specific wp_options entries, and known malware hashes; remediation must rotate passwords and regenerate all TOTP secrets to close the authentication bypass.
• Organizations should treat commercial plugin updates with the same provenance verification, hash checking, and malware scanning applied to any third‑party code, and monitor for unexpected new plugin directories.

Overview of the ShapedPlugin Supply Chain Attack
ShapedPlugin, LLC distributes its free plugins via the WordPress.org repository and sells Pro versions through an Easy Digital Downloads storefront at account.shapedplugin.com. In May 2026 threat actors breached the vendor’s build and distribution infrastructure, compromising the CI/CD pipeline used to assemble Pro plugin packages. The attackers altered exactly four files within a two‑hour window on May 21, 2026, inserting a malicious loader without touching the free‑plugin channel. Wordfence Threat Intelligence identified the compromise as CVE‑2026-10735 (CVSS 9.8 Critical) and linked it to the domains generate.2faplugin.org and the IP address 194.76.217.28:2871, which are registered to AEZA GROUP LLC, a Russian‑based entity. The backdoor remained undetected for more than three weeks until customer reports surfaced on June 10, 2026.

How the Compromise Targeted Paying Customers Only
Because the attackers focused exclusively on the commercial EDD update mechanism, free‑plugin users who rely on the WordPress.org repository were never exposed. Paying customers, however, received the tainted Pro updates when they performed the security‑recommended action of applying licensed updates promptly. This turned a security‑conscious behavior—keeping plugins up‑to‑date—into the very delivery vector for the malware. Consequently, sites running Product Slider Pro < 3.5.4, Real Testimonials Pro 3.2.5, or Smart Post Show Pro < 4.0.2 that installed updates between May and June 2026 should be considered compromised until scanned and cleaned.

Technical Anatomy of the LicenseLoader.php Loader
The initial infection vector is a file named LicenseLoader.php embedded in the compromised Pro plugin ZIPs. Upon a WordPress administrator loading the admin panel, the loader executes and contacts the command‑and‑control server at 194.76.217.28:2871 over HTTPS. It downloads a second‑stage payload, writes it to wp‑content/plugins/ as a fake plugin whose directory name mimics WooCommerce components (woocommerce‑subscription or woocommerce‑notification) but uses the singular form to avoid collision with the legitimate plural‑named WooCommerce Subscriptions plugin. After installing the fake plugin, the loader calls unlink(__FILE__) to delete itself, erasing the primary infection artifact and leaving only the persistent second‑stage components behind.

Inside the Second‑Stage Payload: Files and Capabilities
Wordfence’s analysis uncovered seven distinct malicious files bundled with the fake plugin. These include:

1. Tiny File Manager 2.6 – a web‑based file browser enabling arbitrary file upload, edit, and deletion.
2. Adminer 5.2.1 – a lightweight database management interface that can run arbitrary SQL queries.
3. A URL‑parameter webshell that accepts commands via GET/POST parameters.
4. A REST API backdoor at /wp-json/wc/v3/settings/apply that accepts arbitrary file writes, effectively granting remote code execution.
5. A credential stealer that extracts Time‑based One‑Time Password (TOTP) seeds from four popular 2FA plugins: WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, and the Two‑Factor plugin.
6. A hard‑coded MD5 hash that allows authentication as any administrator without knowing their password.
7. Persistence mechanisms that add entries such as theme_options_scripts and wc_nf_install_done to the wp_options table.
   With both the WordPress password and the stolen TOTP seed, an attacker can bypass multi‑factor authentication even after a password reset.

Why Standard WordPress Security Measures Failed
Typical WordPress hardening focuses on core updates, reputable free plugins from WordPress.org, and generic malware scanners that signature‑match known threats. The ShapedPlugin compromise bypassed these defenses because:

• The malicious code arrived through a trusted commercial update channel that most organizations implicitly whitelist.
• The loader self‑deleted after its first run, leaving no obvious file for scanners to detect on disk.
• The fake plugin hid itself from the admin plugin list via the all_plugins filter, thwarting visual inspection.
• The second‑stage payload used legitimate‑looking file names and leveraged widely used Adminer and Tiny File Manager tools, which many scanners consider benign unless specifically flagged for malicious use.
  Thus, the attack exploited the blind spot in supply‑chain trust for paid plugins and the stealthy, file‑less nature of the loader.

Immediate Containment: Detecting and Removing the Backdoor
Response teams should begin with payload‑side indicators, not the removed loader:

1. Scan for fake plugin directories – Look for wp-content/plugins/woocommerce-subscription/ or wp-content/plugins/woocommerce-notification/. Neither uses the legitimate WooCommerce plural form.
2. Check wp_options – Search for the keys theme_options_scripts and wc_nf_install_done, which the backdoor creates for persistence.
3. Run Wordfence or Wordfence CLI with premium signatures – These will detect the known hash of LicenseLoader.php (if any residual copies exist) and the second‑stage components.
4. Delete the fake plugin folders and remove the offending wp_options entries.
5. Verify file integrity – Compare current plugin files against clean versions from the vendor’s official repository or a known‑good backup.

Credential Rotation and MFA Seed Revocation Procedure
Because the malware steals TOTP seeds, changing passwords alone leaves the authentication bypass intact. The correct order is:

1. Rotate WordPress admin passwords and update database credentials in wp-config.php.
2. Revoke and regenerate all TOTP secrets for every 2FA plugin installed on the affected site (WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, Two‑Factor).
3. Review the administrator user list for any unauthorized accounts that may have been created via the REST API backdoor or the MD5‑hash login bypass.
4. Force re‑enrollment of 2FA for all users after the seeds are rotated, ensuring that any stolen seeds are now useless.

Long‑Term Supply Chain Hardening for Commercial Plugins
Organizations must extend the same scrutiny applied to free plugins to commercial update channels:

• Provenance verification – Maintain an internal inventory of approved plugin versions and verify file hashes (SHA‑256) before deployment.
• Automated malware scanning – Integrate CI/CD pipelines that scan incoming plugin ZIPs with multiple anti‑malware engines and YARA rules targeting known loader patterns.
• Monitor for unexpected plugin directories – Deploy file‑integrity monitoring that alerts when new directories appear under wp-content/plugins/ that do not match an approved list.
• Limit update frequency – Use a staging environment to test licensed updates before pushing to production, allowing time for threat intelligence feeds to flag compromised releases.
• Educate administrators – Emphasize that “prompt updates” apply only to verified, trusted sources; blindly updating from vendor storefronts without validation can introduce risk.

By treating commercial plugin updates as third‑party code requiring hash verification, malware scanning, and vigilant monitoring, organizations can close the supply‑chain gap that the ShapedPlugin attack exploited and reduce the likelihood of similar stealthy compromises in the future.