ShapedPlugin update flow hacked to infect WordPress sites

Multiple paid ShapedPlugin WordPress plugins were compromised via the vendor's build/release pipeline, delivering a malicious loader (LicenseLoader.php) that fetched and installed a hidden fake WooCommerce plugin backdoor. The malware exfiltrates WordPress credentials, 2FA secrets, wp-config database/auth keys, SMTP credentials, admin details and recent WooCommerce orders; Wordfence observed infected builds in late May/early June and the vendor published patched releases and mitigation guidance.