ShapedPlugin Pro builds backdoored in the vendor pipeline

Wordfence disclosed in June 2026 that attackers had compromised the build and distribution pipeline of ShapedPlugin, LLC, a WordPress plugin vendor with more than 400,000 active installations of its free products, and had been shipping backdoored commercial builds to paying customers since late May.

ShapedPlugin sells Pro versions of carousel, slider, and testimonial plugins through Easy Digital Downloads at account.shapedplugin.com, while the free versions live on WordPress.org. Only the Pro builds were poisoned. Wordfence called that selectivity notable: the attacker could deploy to both channels but chose the one without WordPress.org's malware scanning, and the one whose users had paid. Site owners who followed every piece of standard advice, buying a license and updating through the official vendor channel, were the ones who got the backdoor.

Wordfence obtained a backdoored copy of Real Testimonials Pro 3.2.5 directly from the vendor's update endpoint on June 12, 2026. It contained a file named src/Includes/LicenseLoader.php, loaded on every admin page by a modified TestimonialPRO.php. The loader pulled a payload from a command-and-control server at 194.76.217.28:2871, installed it with WordPress's own Plugin_Upgrader class, reported the victim domain, then deleted itself and stripped its hook from TestimonialPRO.php. The dropped plugin installed as woocommerce-subscription, singular, a near-match for the legitimate WooCommerce Subscriptions, and hid itself from the plugin list through the all_plugins filter. Inside were Tiny File Manager 2.6, Adminer 5.2.1, a URL parameter webshell, a REST backdoor at /wp-json/wc/v3/settings/apply that accepted arbitrary file writes, and a login bypass keyed to a hardcoded MD5 hash.

The credential module was the part that made cleanup hard. It hooked wp_authenticate and wp_login to capture plaintext passwords, session cookies, and roles, and then went looking for TOTP seeds belonging to four specific two-factor plugins: WP 2FA, Wordfence Login Security, Really Simple SSL 2FA, and the Two-Factor plugin. Everything went to generate.2faplugin.org, a domain registered to blend into legitimate 2FA traffic. With both a password and a TOTP seed, an attacker keeps access after the victim rotates the password. Timestamps inside the compromised ZIP pointed at an automated build step rather than hand tampering, with four files changed on May 21 inside a two-hour window against a baseline of 366 files from April 2025 and 100 from February 2026. Wordfence contacted ShapedPlugin on June 15, and the vendor said the following day that it had begun an investigation, was reviewing its distribution and release processes, and would publish verified rebuilds. A related backdoor in Product Slider Pro had already been assigned CVE-2026-49777 and patched in 3.5.4, but Wordfence found compromised packages still being served for other Pro products at the time of writing.