ShapedPlugin Update Flow Hacked to Infect WordPress Sites

A supply-chain attack compromised ShapedPlugin's proprietary update infrastructure to distribute trojanized premium WordPress plugin updates to paying customers; malicious updates were staged as legitimate releases, delivered via the vendor's official update channel, and executed on sites after installation. The report highlights the heightened risk in premium plugin ecosystems due to automatic updates and lack of central repository integrity checks, recommends immediate auditing of recent updates, file integrity scans, log review, disabling automatic updates for third-party commercial plugins, and staging updates before production deployment.