Threat Intelligence Brief
Curated summary with source attribution
Source: cybersecurity-insiders.com
Threat Risk: High
Victim: WordPress site owners using ShapedPlugin Pro products
Incident: A supply chain compromise of ShapedPlugin’s paid update system distributed backdoored plugins to customers.
Impact: Remote attackers gained persistence and unauthorized access to WordPress sites via a stealthy, hidden payload.
Attacker: Unidentified threat actors
Analysis: Attackers compromised ShapedPlugin’s CI/CD pipeline to inject a malicious loader into paid WordPress plugins. This loader fetches a second-stage payload that masquerades as WooCommerce components and hides from the administrative plugin list to evade detection. The precision of the attack suggests a targeted effort to exploit the trust inherent in commercial update channels.
Recommendations: Update all ShapedPlugin Pro products to the latest patched versions immediately; Perform a deep file-system scan for unauthorized directories mimicking WooCommerce components; Rotate all site administrative credentials and database passwords for affected environments
Source: Cybersecurity Insiders
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source