WordPress Plugins Backdoored in Supply Chain Attack

If you paid for a ShapedPlugin Pro plugin and updated it recently, you may have installed a backdoor alongside it.

Attackers broke into ShapedPlugin's build and distribution pipeline — the system responsible for packaging and delivering software updates — and quietly injected malicious code into three Pro plugin releases: Product Slider Pro for WooCommerce (versions before 3.5.4), Real Testimonials Pro (version 3.2.5), and Smart Post Show Pro (versions before 4.0.2). Free versions on WordPress.org were not affected.

The attack carries CVE-2026-49777 (CVSS 10.0 — the maximum possible score) for the Product Slider Pro compromise specifically, and CVE-2026-10735 (CVSS 9.8 — Critical) covering the wider incident.

Once a compromised plugin was installed, it silently fetched a payload from a remote server, activated it as a fake plugin hidden from the WordPress admin panel, then erased itself to cover its tracks. What it left behind was considerably worse: a persistent backdoor capable of writing arbitrary files, a web shell (a remote command-execution tool embedded in the server), and a credential harvester that captured login details and two-factor authentication codes in plain text.

Before deleting itself, it also extracted the full contents of your site's configuration file — including database credentials and encryption keys — all administrator account details, email plugin credentials, and three months of WooCommerce order data.

ShapedPlugin has confirmed the breach. New versions are expected to be released pending full security reviews, though no release dates have been confirmed.

What to do:

1. Check if you're running Product Slider Pro for WooCommerce (before 3.5.4), Real Testimonials Pro (3.2.5), or Smart Post Show Pro (before 4.0.2). If yes, treat your site as compromised.
2. Reset every password — WordPress admin accounts, database, hosting panel, and email credentials.
3. Revoke and regenerate 2FA secrets for all users.
4. Audit your administrator accounts list for any accounts you did not create.
5. Check your mail plugin settings for modified SMTP credentials.
6. Once clean, update to patched versions as soon as ShapedPlugin releases them.

Security researcher and SANS Institute author Ismael Valenzuela has published an analysis on agentic AI — systems that do not just assist attackers but act autonomously on their behalf — and the picture is unsettling. According to The Hacker News, the shift from AI-as-assistant to AI-as-agent means an attacker no longer needs to carry out each step of an attack manually. They set an objective; the agent walks the path.

The practical consequence: attackers with little to no technical skill can now run sophisticated, multi-step campaigns. The Canadian Centre for Cyber Security has already warned that AI-driven exploitation may outpace vendors' ability to release patches.

For defenders, there is a narrow silver lining. Because unskilled attackers using similar AI models tend to produce similar attack patterns, those patterns become recognisable — and detectable. The organisations that learn those patterns now will be ahead of the ones that do not.

What FFmpeg is: FFmpeg is an open-source library used by hundreds of applications — including Kodi, OBS Studio, Jellyfin, Nextcloud, PhotoPrism, and messaging platforms like Slack and Telegram — to process, decode, and encode video files.

What it is: A heap out-of-bounds write (a memory corruption flaw where the software writes data beyond its allocated memory space, like writing past the end of a notepad and overwriting whatever is on the next page) in FFmpeg's MagicYUV video decoder. The vulnerability, nicknamed PixelSmash by researchers at JFrog, earned a CVSS score of 8.8.

Who's at risk: Anyone running software that uses FFmpeg's libavcodec library with the MagicYUV decoder enabled. This includes self-hosted media servers like Jellyfin and Nextcloud, media players like Kodi, streaming tools like OBS Studio, photo managers like PhotoPrism, and desktop thumbnail generators in GNOME, KDE, and XFCE. Plex uses a custom FFmpeg build with decoders restricted to an allowlist, which mitigates this specific risk.

CVSS: 8.8 — High. Patch this week.

Root cause: The MagicYUV decoder splits video frames into independent regions called slices, which can be decoded separately. The flaw exists because the frame allocator and the decoder calculate the height of the chroma plane (a component of colour data in video) differently. That mismatch means the decoder writes one row of pixel data beyond the end of the memory it was allocated — a one-row overflow that is small but reliably exploitable for a crash, and potentially worse under the right conditions.

Attack vector: An attacker crafts a malicious video file in AVI, MKV, or MOV format and delivers it to a target system. The flaw triggers when the file is opened directly, when a file manager generates a thumbnail preview, or when an automated media ingestion workflow — such as Jellyfin's library scan — processes the file automatically. For a denial-of-service (DoS) condition, this is reliable. For remote code execution (RCE) on Jellyfin, researchers demonstrated a full exploit, but this required ASLR (Address Space Layout Randomization — a memory protection that randomises where code is loaded to make exploitation harder) to be disabled, or chaining with a separate vulnerability to bypass it. DoS without ASLR disabled is the more realistic near-term risk for most deployments. A particularly low-friction attack scenario involves seeding a malicious video file via torrent, pointed at a Jellyfin media library — the server's own file monitor then triggers the exploit automatically, with no user action required.

Detection strategies:

1. Check application logs for FFmpeg or ffprobe crashes, segmentation faults, or unexpected process terminations — particularly during media library scans.
2. Monitor for unusual outbound network connections from your media server process, which could indicate a successful exploit on systems with ASLR disabled.
3. If running Jellyfin, review library scan logs for errors referencing MagicYUV or AVI files added around the time of any suspected incident.

Recommended actions:

1. Upgrade FFmpeg to version 8.1.2 or later. Jellyfin has already updated its bundled FFmpeg — update Jellyfin itself to get the fix.
2. If you cannot patch immediately, add AVI files containing MagicYUV-encoded video to a blocklist where your application supports it. PhotoPrism is already working on this.
3. Ensure ASLR is enabled on any server running media processing software — this significantly raises the bar for RCE exploitation.

OpenAI has rolled out an upgraded AI model called GPT-5.5-Cyber through its Daybreak security initiative, and alongside it, an updated Codex Security plugin that goes beyond flagging vulnerabilities to actually generating patches. According to The Hacker News, the tool can scan large codebases, trace attack paths, validate findings, and produce codebase-specific fixes ready for human review.

If you maintain or contribute to open-source software, the associated Patch the Planet initiative — run in partnership with security firm Trail of Bits — is accepting participation from projects including cURL, Python, and others.

Access is currently limited to trusted defenders through the Daybreak programme. If you qualify, it is worth applying. If you do not, watch this space — the tooling is moving fast.

Learn more and apply here

President Trump signed Executive Order 14409 on Monday, directing federal agencies and their contractors to migrate to post-quantum cryptography (PQC) — encryption designed to resist attacks from future quantum computers — by the end of 2030 for key establishment and 2031 for digital signatures, according to Security Week. The order targets the "harvest now, decrypt later" threat, where attackers collect encrypted data today to decrypt it once quantum computing matures. If your organisation contracts with the US federal government, compliance by 2030 is now a legal requirement, not a roadmap item.