ShapedPlugin Pro WordPress plugins backdoored via compromised update pipeline

Intelligence Summary

ShapedPlugin WordPress Pro plugins were compromised through a supply chain tampering of the vendor’s build and distribution process. Threat actors inserted backdoor functionality into plugin releases delivered via official licensed update channels. Sites that installed or updated the affected plugins may have received the malicious code without noticing. This raises the risk of unauthorized access and subsequent compromise of WordPress environments. Admins should check for affected plugin versions, review unexpected behavior, and apply safe updates or remediation guidance from the vendor and security advisories.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics