EUVD-2026-34792
GHSA-r843-rvx7-3rjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress sites running Product Slider Pro < 3.5.3
-
DeliverySend crafted request to backdoored plugin endpoint
-
ExploitExecute attacker code as PHP user
-
ExecutionCross trust boundary (scope change)
-
PersistInstall persistent web shell
-
ImpactExfiltrate WooCommerce customer and order data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site that has the Product Slider Pro for WooCommerce plugin installed at a version prior to 3.5.3 (including 3.5.2 instances that were not reinstalled after the silent fix). The CVSS vector confirms AV:N/AC:L/PR:N/UI:N, meaning no authentication, no user interaction, and no non-default settings are required; the only practical limiter is that the plugin must be installed and activated on the target site, and the site must be reachable over the network. |
| Impact | All signals point to maximum priority: the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects remote, unauthenticated, low-complexity exploitation with scope change and full CIA impact - the textbook 10.0. The vulnerability is not currently listed in CISA KEV and no EPSS score was provided in the input, so probabilistic exploitation likelihood is unknown; similarly, no public PoC is referenced. There is a meaningful data conflict: the supplied Tags label this 'Information Disclosure,' while the description and Patchstack URL describe a backdoor - the backdoor framing is consistent with the 10.0 score and CIA:H/H/H impact, so the 'Information Disclosure' tag appears to understate the issue. The most operationally significant risk multiplier is that the vendor refused to mint a new version, meaning defenders cannot confirm patched state via plugin metadata. |
| Exploit ScenarioDerived | An unauthenticated attacker scans the internet for WordPress sites running Product Slider Pro for WooCommerce and issues a single crafted HTTP request to the backdoored endpoint embedded in the plugin, which executes attacker-supplied code with PHP-process privileges. With scope change and full impact per the CVSS vector, the attacker pivots into the WordPress database to exfiltrate customer/order data, drops a persistent web shell, and abuses WooCommerce admin functions - all without prior credentials or user interaction. No public PoC is referenced in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Backdoor/malicious code implant in the ShapedPlugin Product Slider Pro for WooCommerce WordPress plugin (versions before 3.5.3) allows remote unauthenticated attackers full compromise of the hosting site with CVSS 10.0 and a scope-changing vector. The Patchstack reference characterizes this as a backdoor vulnerability, and no public exploit has been identified at the time of analysis, though the trivial nature of supply-chain implants means abuse is plausible. Notably, the vendor patched the existing release without bumping the version number, so administrators cannot reliably tell whether their installation is fixed.
RemediationAI
Upstream fix available but no vendor-released patched version identifier exists - the vendor silently corrected the existing release without bumping the version, so administrators should reinstall Product Slider Pro for WooCommerce directly from ShapedPlugin, replacing all plugin files on disk to ensure the malicious code is removed, and verify file hashes against a freshly downloaded copy rather than trusting the displayed version string. Because this is described as a backdoor implant, also audit wp-content/plugins/woo-product-slider-pro/ for unexpected PHP files, scan the WordPress database for unknown admin users and scheduled tasks, rotate all WordPress secrets (wp-config.php SALTs, admin passwords, API keys) and review web logs for prior abuse before the reinstall. As a compensating control until reinstallation, deactivate and delete the plugin (this removes the product slider feature from storefronts) or place the plugin's endpoints behind a WAF rule blocking unauthenticated access - see https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability for advisory details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Product Slider Pro for WooCommerce is a commercial WordPress plugin from ShapedPlugin, LLC that renders product carousels/sliders inside WooCommerce storefronts. The weakness is mapped to CWE-1284 (Improper Validation of Specified Quantity in Input), but Patchstack's intelligence and the description's 'Malicious Software Implanted' language indicate that vulnerable releases shipped with attacker-controllable or backdoor functionality embedded in the plugin code itself - a supply-chain style compromise rather than a typical input-handling bug. Because WordPress plugins execute inside the PHP request lifecycle with site-level privileges, any reachable backdoor endpoint effectively grants the attacker the same authority as the web application user. No CPE strings were supplied in the intelligence package, so exact CPE enumeration cannot be performed.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (patchstack) · only source for this CVE.
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.
This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3.
No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.
Articles & Coverage 2
Executive ViewAI
ShapedPlugin Product Slider Pro for WooCommerce contains a critical backdoor vulnerability (CVSS 10.0) affecting WordPress sites using versions before 3.5.3, enabling unauthenticated remote attackers to achieve full site compromise and complete control of hosted content. Any organization running this plugin faces immediate risk of data breach, service disruption, and customer trust degradation.
Since no reliably verifiable vendor patch is available, interim mitigations are required: (1) Immediately disable the plugin on all sites-this is the primary control; (2) If business requires slider functionality remain active temporarily, restrict plugin access via Web Application Firewall rules, IP whitelisting, or disabling slider endpoints not essential to core operations; (3) Implement enhanced logging and intrusion detection focused on plugin file modifications and unauthorized administrative access; (4) Conduct forensic analysis on all affected sites for backdoor presence before re-enabling any related functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB