ShapedPlugin WordPress updates hijacked to deliver malware via vendor system

Intelligence Summary

ShapedPlugin’s official update mechanism was compromised in a supply-chain incident. Multiple WordPress plugins distributed through the vendor’s update system were replaced with infected releases. Sites belonging to paying customers were exposed when they installed the tainted updates. The campaign leveraged the legitimate update flow to deliver the malicious payload with little user friction. WordPress site owners should review installed ShapedPlugin components, check for unexpected files, and consider reinstalling from trusted sources.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics