WordPress sites infected through compromised ShapedPlugin plugins

Three paid ShapedPlugin WordPress plugins were compromised in a supply-chain attack. Infected releases were distributed to paying customers through the vendor’s official update channel. The malware installed a fake plugin impersonating WooCommerce components, stole credentials and other sensitive information, and gave operators remote file-writing capabilities.