ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack

A supply‑chain attack compromised ShapedPlugin's paid WordPress Pro plugins distributed via the vendor's Easy Digital Downloads infrastructure, injecting a loader that fetched and installed a hidden backdoor (contacting 194.76.217.28:2871), which created a fake plugin, exfiltrated wp-config and mail/WooCommerce data, captured credentials and 2FA codes, and provided remote code execution and persistence; CVEs were assigned and the vendor is reviewing distribution processes while recommending password and 2FA resets.