Brief Summary: CVE-2026-49777 — CVSS 10.0 Backdoor in Product Slider Pro for WooCommerce - ZeroPath Blog

Introduction

A backdoor planted in ShapedPlugin LLC's Product Slider Pro for WooCommerce plugin has a CVSS score of 10.0, the maximum possible severity rating. It lets unauthenticated remote attackers implant malicious software and keep persistent access to any affected WordPress site. Making matters worse, the vendor patched the existing version in place without releasing a new version number, so site operators cannot reliably tell whether their installation is safe by checking the version string.

Product Slider Pro for WooCommerce is a commercial WordPress/WooCommerce plugin that lets store owners display product carousels, sliders, and grid galleries on their sites. The developer, ShapedPlugin LLC, has been building WordPress plugins since 2015. Its portfolio includes WP Carousel, Logo Carousel, Smart Post, Easy Accordion, and several other plugins. The free version of Product Slider for WooCommerce has been listed on WordPress.org since April 2016, while the Pro version is sold through the vendor's own website at wooproductslider.io.

Technical Information

Root Cause and Vulnerability Classification

CVE-2026-49777 is classified under CWE-1284: Improper Validation of Specified Quantity in Input. CWE-1284 describes a weakness where a product receives input expected to specify a quantity (such as size, length, frequency, price, rate, number of operations, or time) but does not validate or incorrectly validates that the quantity has the required properties. CWE-1284 is a child of CWE-20 (Improper Input Validation) and can precede CWE-789 (Memory Allocation with Excessive Size Value). In this CVE, improper validation of a quantity-related input parameter allowed malicious software to be implanted into the plugin, which in effect created a backdoor.

The Patchstack advisory describes the vulnerability as a backdoor that lets attackers "gain access and exploit your website at any time they desire," including the ability to "execute a payload to inject advertisements." Patchstack explicitly warns that "any website that currently has or has had this compromised version of the plugin should be considered compromised."

CVSS Vector Breakdown

The CVSS 10.0 score reflects the worst-case value for every base metric:

CVSS Metric	Value	Rationale
Attack Vector	Network	Exploitable remotely over the internet
Attack Complexity	Low	Trivial exploitation, no special conditions required
Privileges Required	None	No authentication needed
User Interaction	None	No user action required for exploitation
Scope	Changed	Impacts beyond the vulnerable component
Confidentiality	High	Complete information disclosure
Integrity	High	Complete system integrity compromise
Availability	High	Complete system availability loss

Attack Flow

Based on the Patchstack advisory and the vulnerability's characteristics, the attack proceeds in four stages:

Initial Access: An unauthenticated remote attacker sends a crafted request to an affected WordPress site running a vulnerable version of Product Slider Pro for WooCommerce. No credentials, session tokens, or user interaction are required.
Backdoor Activation: The malicious file planted in the plugin processes the attacker's request. The CWE-1284 classification indicates that improper validation of a quantity-related input parameter enables the malicious code path.
Payload Execution: The attacker can execute arbitrary payloads through the backdoor. Patchstack mentions advertisement injection specifically, but the backdoor is not limited to that. Given CVSS impact ratings of High for confidentiality, integrity, and availability, full site takeover is possible.
Persistence: The backdoor gives persistent access, so the attacker can return at any time without re-exploiting the vulnerability. This is consistent with the "Malicious Software Implanted" attack pattern described in the NVD entry.

Comparison with the Essential Plugin Supply-Chain Attack

The exact malicious code in CVE-2026-49777 has not been publicly documented in detail. The April 2026 Essential Plugin supply-chain attack, however, is a well-documented reference for how WordPress plugin backdoors typically work. In that incident, over 30 plugins were compromised after a malicious actor acquired them through the Flippa marketplace. The backdoor relied on:

A PHP deserialization backdoor using unserialize() on data fetched from an attacker-controlled server
An unauthenticated REST API endpoint configured with permission_callback: __return_true
A phone-home mechanism that downloaded additional payloads from command-and-control infrastructure
Injection of malicious PHP into wp-config.php for persistence
Command-and-control domain resolution through an Ethereum smart contract, which made traditional domain takedowns ineffective

The Essential Plugin attack lay dormant for about 8 months (August 2025 to April 2026) before it was discovered. It affected hundreds of thousands of active installations across 31 plugins, which WordPress.org ultimately closed.

Public sources do not yet say whether CVE-2026-49777 follows this exact pattern or uses a different technical approach. The CWE-1284 classification suggests a different initial entry mechanism from Essential Plugin's PHP deserialization, but the strategic outcome is the same. In both cases, malicious software implanted in a trusted plugin enables persistent unauthorized access.

The Version Verification Problem

The vendor's patching approach complicates things further. ShapedPlugin applied a fix to the existing version 3.5.3 release without publishing a new version number. Two installations that both report "version 3.5.3" could therefore be in entirely different security states, one running the compromised code and the other running the patched code. Standard WordPress update mechanisms and version-based vulnerability scanners cannot tell them apart. For precisely this reason, Patchstack treats 3.5.3 as an unpatched version.

Affected Systems and Versions

The vulnerability affects Product Slider Pro for WooCommerce by ShapedPlugin LLC:

Affected versions: All versions from the initial release through version 3.5.2
Version 3.5.3 status: Ambiguous. The vendor applied a fix to the existing 3.5.3 release without issuing a new version number. Installations reporting version 3.5.3 may or may not contain the fix, depending on when the plugin files were downloaded.
Plugin slug: woo-product-slider-pro
Distribution channel: Commercial plugin sold through wooproductslider.io (not listed in the WordPress.org plugin directory)

The free version of Product Slider for WooCommerce (slug: woo-product-slider), distributed through WordPress.org, is a separate product. The CVE specifically references the Pro (commercial) version.

Vendor Security History

ShapedPlugin LLC has 5 published CVE records since 2024, with an average CVSS base score of 6.2. Before CVE-2026-49777, the vendor had zero entries in CISA's Known Exploited Vulnerabilities catalog and zero known public exploits.

Metric	Value
Published CVEs (since 2024)	5
Average CVSS Score (prior CVEs)	6.2
CISA KEV Entries	0
Known Public Exploits (prior)	0
CVE-2026-49777 CVSS	10.0

The jump from an average of 6.2 to a perfect 10.0 is large. A backdoor is qualitatively different from the kinds of issues (typically cross-site scripting or access-control flaws) that score in the 6.x range. That suggests either a compromise of the vendor's development or distribution pipeline, or deliberately inserted malicious code, rather than an ordinary coding error.

Patching version 3.5.3 in place without a new version number also raises concerns about the vendor's release-management practices. Standard security practice requires patches to ship under a new, distinguishable version number, so that both automated and manual version-based vulnerability detection can work.

Brief Summary: CVE-2026-49777 — CVSS 10.0 Backdoor in Product Slider Pro for WooCommerce

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information