ShapedPlugin update flow hacked to infect WordPress sites

Attackers compromised ShapedPlugin's software build and distribution pipeline, allowing them to inject malicious code into legitimate paid plugin updates before they reached end-user WordPress sites. This is a classic supply chain attack: users who trusted the vendor's official update mechanism became victims despite taking no direct action themselves. The malware installed a covert fake WooCommerce plugin to harvest credentials, 2FA secrets, and payment data — high-value targets that can enable further fraud and account takeover. This incident highlights that trusting a vendor's update channel is not sufficient; the integrity of the build and delivery pipeline itself must be verified. Organizations must treat third-party plugin updates as a potential attack vector and implement controls to detect unauthorized changes.