What is the CVSS score of CVE-2026-49777?

CVE-2026-49777 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Product Slider Pro are affected by CVE-2026-49777?

ShapedPlugin Product Slider Pro for WooCommerce contains a critical backdoor vulnerability (CVSS 10.0) affecting WordPress sites using versions before 3.5.3, enabling unauthenticated remote attackers…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49777?

Yes, a public proof-of-concept exploit is available for CVE-2026-49777. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-49777?

Within 24 hours: Audit all WordPress installations to identify sites using ShapedPlugin Product Slider Pro; prepare plugin disablement procedures and verify backup integrity. Within 7 days: Immediately disable and remove the vulnerable plugin from all affected installations; scan sites for unauthorized access, backdoor artifacts, and data exfiltration indicators; preserve logs for forensic review. Within 30 days: Identify and deploy alternative product slider solutions; monitor vendor statements for reliable patching guidance (note: vendor has patched-in-place without version increment, making patch verification unreliable); implement application security controls to detect similar plugin-based attacks.

Product Slider Pro CVE-2026-49777

EUVD-2026-34792 CRITICAL

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-06-05 audit@patchstack.com

GHSA-r843-rvx7-3rjg

Information Disclosure WordPress

10.0

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 05, 2026 - 11:01 EUVD

Analysis Generated

Jun 05, 2026 - 09:31 vuln.today

CVE Published

Jun 05, 2026 - 09:16 nvd

CRITICAL 10.0

DescriptionCVE.org

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.

This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3.

No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.

Articles & Coverage 2

POC POC: CVE-2026-49777-CVE-2026-10735 Jun 21, 2026 POC CVE-2026-49777: Critical Unauthenticated RCE Backdoor in ShapedPlugin Product Slider Pro for WooCommerce (CVSS 10.0) Jun 12, 2026

AnalysisAI

Backdoor/malicious code implant in the ShapedPlugin Product Slider Pro for WooCommerce WordPress plugin (versions before 3.5.3) allows remote unauthenticated attackers full compromise of the hosting site with CVSS 10.0 and a scope-changing vector. The Patchstack reference characterizes this as a backdoor vulnerability, and no public exploit has been identified at the time of analysis, though the trivial nature of supply-chain implants means abuse is plausible. Notably, the vendor patched the existing release without bumping the version number, so administrators cannot reliably tell whether their installation is fixed.

Technical ContextAI

Product Slider Pro for WooCommerce is a commercial WordPress plugin from ShapedPlugin, LLC that renders product carousels/sliders inside WooCommerce storefronts. The weakness is mapped to CWE-1284 (Improper Validation of Specified Quantity in Input), but Patchstack's intelligence and the description's 'Malicious Software Implanted' language indicate that vulnerable releases shipped with attacker-controllable or backdoor functionality embedded in the plugin code itself - a supply-chain style compromise rather than a typical input-handling bug. Because WordPress plugins execute inside the PHP request lifecycle with site-level privileges, any reachable backdoor endpoint effectively grants the attacker the same authority as the web application user. No CPE strings were supplied in the intelligence package, so exact CPE enumeration cannot be performed.

RemediationAI

Upstream fix available but no vendor-released patched version identifier exists - the vendor silently corrected the existing release without bumping the version, so administrators should reinstall Product Slider Pro for WooCommerce directly from ShapedPlugin, replacing all plugin files on disk to ensure the malicious code is removed, and verify file hashes against a freshly downloaded copy rather than trusting the displayed version string. Because this is described as a backdoor implant, also audit wp-content/plugins/woo-product-slider-pro/ for unexpected PHP files, scan the WordPress database for unknown admin users and scheduled tasks, rotate all WordPress secrets (wp-config.php SALTs, admin passwords, API keys) and review web logs for prior abuse before the reinstall. As a compensating control until reinstallation, deactivate and delete the plugin (this removes the product slider feature from storefronts) or place the plugin's endpoints behind a WAF rule blocking unauthenticated access - see https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability for advisory details.