What is the CVSS score of CVE-2026-10735?

CVE-2026-10735 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Smart Post Show Pro are affected by CVE-2026-10735?

Three commercial WordPress plugins (Smart Post Show Pro, Real Testimonials Pro, Product Slider for WooCommerce Pro) were compromised at their update servers to distribute malicious code, enabling…. A patch is available.

Is there a public PoC exploit available for CVE-2026-10735?

Yes, a public proof-of-concept exploit is available for CVE-2026-10735. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-10735?

Within 24 hours, audit all WordPress installations to identify deployment of the three affected plugins (Smart Post Show Pro, Real Testimonials Pro, Product Slider for WooCommerce Pro). Within 7 days, apply vendor-released patches immediately: upgrade Smart Post Show Pro to 4.0.2 or later, Real Testimonials Pro to 3.2.5 or later, and Product Slider for WooCommerce Pro to 3.5.3 or later; run security scans for indicators of compromise on all affected sites. Within 30 days, force password resets for all WordPress administrative accounts, conduct comprehensive credential access audits, and implement Web Application Firewall rules to monitor for suspicious plugin activity.

Smart Post Show Pro CVE-2026-10735

EUVD-2026-38693 HIGH

2026-06-24 WPScan

GHSA-h5xm-xf2g-27wp

WordPress Information Disclosure Smart Post Show Pro Real Testimonials Pro Product Slider For Woocommerce Pro

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.8 CRITICAL

Trojanized plugin runs unauthenticated with full site privileges (AV:N/AC:L/PR:N/UI:N); 'full control' plus credential exfiltration justifies C:H/I:H/A:H, exceeding the input vector's C-only scoring.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:03 vuln.today

Patch available

Jun 24, 2026 - 08:16 EUVD

CVE Published

Jun 24, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Articles & Coverage 2

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026 POC POC: CVE-2026-49777-CVE-2026-10735 Jun 21, 2026

AnalysisAI

Supply-chain compromise of three commercial WordPress plugins - Smart Post Show Pro (before 4.0.2), Real Testimonials Pro (before 3.2.5), and Product Slider for WooCommerce Pro (before 3.5.3) - shipped malicious code via the vendor's compromised update server, letting remote unauthenticated attackers deploy a second-stage payload that harvests credentials and other sensitive data and takes full control of affected sites. Publicly available exploit code exists and a patch is available from the vendor, but there is no public exploit identified as being used for active exploitation and the flaw is not in CISA KEV. EPSS is low (0.20%, 10th percentile), consistent with the malicious builds having been pulled once discovered rather than being mass-exploited in the wild.

Technical ContextAI

This is not a code-level defect in the plugins' own logic but a distribution/trust compromise: the affected products are premium WordPress plugins (PHP code running with full site privileges inside the WordPress runtime) that were tampered with upstream and delivered to site owners through the vendor's automatic update channel. Because a WordPress plugin executes on every request with access to the database, wp-config secrets, and admin sessions, embedded malicious code can act as a first-stage loader that fetches and runs a second-stage payload. No CWE was assigned by NVD, but the behavior maps to CWE-506 (Embedded Malicious Code) with an underlying CWE-494 (Download of Code Without Integrity Check) at the update-server trust boundary; the resulting activity (credential and data exfiltration) is why the record is tagged Information Disclosure. CPE strings reference the three plugin slugs under an 'unknown' vendor, and the EUVD entry pins the last-good versus first-fixed builds.

RemediationAI

Update immediately to the vendor-released patched builds - Smart Post Show Pro 4.0.2, Real Testimonials Pro 3.2.5, and Product Slider for WooCommerce Pro 3.5.3 - obtained directly from the vendor, per the WPScan advisory (https://wpscan.com/vulnerability/160ee7f7-91b6-4cce-9462-837130621402/). Because this was a supply-chain compromise rather than an exploitable code bug, patching alone is insufficient for sites that ran a tainted version: treat those installs as compromised, rotate all WordPress credentials, database passwords, API keys and secrets stored in wp-config, and invalidate active admin sessions and salts; audit for injected admin users, unknown scheduled tasks (WP-Cron), and unexpected outbound connections indicating a deployed second-stage payload. If you cannot immediately update, deactivate and remove the affected plugin (trade-off: loss of that plugin's site functionality) and restrict outbound network egress from the web host to break second-stage retrieval and exfiltration. Consider restoring from a known-clean backup predating the tainted update and re-scanning the filesystem for webshells before returning the site to service.