Malicious Code Distribution in Shapedsmart-post-show-pro, Real Testimonials Pro, and Product Slider for WooCommerce Plugins
CVE-2026-10735
Currently unrated
What is CVE-2026-10735?
The Shapedsmart-post-show-pro, Real Testimonials Pro, and Product Slider for WooCommerce Pro WordPress plugins have been compromised through a vendor's update server, allowing attackers to inject malicious code. This vulnerability enables unauthenticated users to execute a second-stage payload capable of exfiltrating sensitive data, including user credentials, and granting them full control over compromised WordPress sites.
Affected Version(s)
Product Slider for WooCommerce Pro 3.5.2 < 3.5.3
Real Testimonials Pro 3.2.4 < 3.2.5
smart-post-show-pro 4.0.1 < 4.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.