CVE-2026-10735: ShapedPlugin Multiple Pro Plugins…

Record summary

CVE-2026-10735 has a selected CVSS score of 7.5 (high); EIP currently links 2 repository PoCs.

Description

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Jun 16, 2026 · VulnCheck
Reported exploitation: Observed · VulnCheck

Available material

Repository PoCs: 2

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 24, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
ShapedPlugin Pro Browse ShapedPlugin / ShapedPlugin Pro	VulnCheck	Version data not supplied
Product Slider for WooCommerce Pro Default status: unaffected	CVE List	3.5.2 to < 3.5.3	affected
Real Testimonials Pro Default status: unaffected	CVE List	3.2.4 to < 3.2.5	affected
smart-post-show-pro Default status: unaffected	CVE List	4.0.1 to < 4.0.2	affected

Proofs of concept

Repository PoCs

GitHubxxconi/CVE-2026-49777-CVE-2026-10735Repository PoCby xxconi0Exploit3 files

101.9 KiB · linked to 2 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Python script that performs a multi-step exploitation chain against WordPress sites running vulnerable ShapedPlugin plugins. It detects indicators of compromise, bypasses login using a hardcoded MD5 hash, writes a webshell via a REST API backdoor, executes arbitrary OS commands, and exfiltrates credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a Python script that automates exploitation of known backdoors in vulnerable WordPress plugins. It does not contain any backdoor or deceptive payload aimed at the person running the PoC. All behavior is consistent with a public exploit tool: it scans targets, attempts login bypass, writes a webshell, executes commands, and exfiltrates data from the target server. No concealed operator-directed harm against the PoC runner was observed.

ClassificationExploit

Model confidence98%

AuthenticationNot required

Languagespython

Target softwareWordPresswoo-product-slider-protestimonial-prosmart-show-post-pro

Attack typesbackdoorremote code executioncredential exfiltrationauthentication bypass

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs exploitation steps including login bypass, webshell deployment, remote command execution, and data exfiltration. It is not limited to detection or validation; it exercises the vulnerability to gain unauthorized access and control.

CVE-2026-49777.py:326-401

Requirements

Target must be running a vulnerable version of one of the affected ShapedPlugin plugins with the backdoor code present.CVE-2026-49777.py:449-452

Observed behavior

Detects backdoor indicators by checking for fake plugin directories, known IOC file paths, and a specific HTTP response header (X-Cache-Status).CVE-2026-49777.py:91-125
Bypasses WordPress login by sending a hardcoded MD5 hash as the password to wp-login.php.CVE-2026-49777.py:130-167
Writes a PHP webshell to the uploads directory via a POST request to a backdoored REST API endpoint (/wp-json/wc/v3/settings/apply).CVE-2026-49777.py:172-199
Executes arbitrary OS commands by sending a base64-encoded command to a backdoored diagnostics file or by injecting a command into the X-Forwarded-For header.CVE-2026-49777.py:204-261
Exfiltrates sensitive data including wp-config.php contents, database credentials, and checks for Adminer and file manager access.CVE-2026-49777.py:266-321

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain: Payload withheldThe script implements a documented attack chain (IOC detection, login bypass, REST API backdoor, webshell RCE, data exfiltration) against vulnerable WordPress plugins. This is normal exploit behavior, not a backdoor against the user.CVE-2026-49777.py:50-66CVE-2026-49777.py:88-125CVE-2026-49777.py:127-167CVE-2026-49777.py:169-199CVE-2026-49777.py:201-261CVE-2026-49777.py:263-321
Hardcoded Credentials: Payload withheldUsed as a login bypass token and REST API auth token against the target. This is part of the documented exploit, not a credential that harms the PoC runner.CVE-2026-49777.py:51
Output File: Payload withheldThe script saves successful exploitation results locally. This is expected logging for an exploit tool and does not exfiltrate data from the runner's machine.CVE-2026-49777.py:46CVE-2026-49777.py:82-86
Contact Information: Payload withheldDisplayed in the banner and README. This is author contact information, not executable behavior.CVE-2026-49777.py:42README.md:2

Review boundaries

What the analysis did not establish

Evidence includes only the Python script and README; the repository contains one non-text file (likely an image) that was not analyzed.
The script's actual effectiveness or safety is not verified; classification is based solely on code intent and structure.
One non-text media file (82730 bytes) was present in the repository but was not analyzed; its content is unknown.
The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubHORKimhab/CVE-WordpressRepository PoCby HORKimhab0Exploit10 files

138.0 KiB · linked to 2 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-13

Technical assessment

The primary artifact is a Python script (CVE-2026-49777.py) that attempts to exploit CVE-2026-49777 by triggering a malicious software download endpoint on a target WordPress site. It includes functions to detect the vulnerable plugin, send crafted HTTP requests to known vulnerable endpoints, and check for indicators of compromise. The script's stated purpose is to achieve unauthenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC scripts are exploit tools targeting disclosed WordPress plugin backdoors (CVE-2026-49777, CVE-2026-10735). They perform IOC detection, login bypass, REST API file write, webshell RCE, and data exfiltration against remote targets. All actions are directed at the operator-supplied target URL; no evidence of concealed local execution, data exfiltration to an undisclosed third party, or other deceptive harm to the operator was found.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesPython

Target softwareWordPressProduct Slider Pro for WooCommerce

Attack typesRemote Code ExecutionMalicious Software Implantation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to exploit a vulnerability by sending crafted requests to trigger a malicious software download, which is the definition of an exploit. The code includes functions named 'exploit_rce' and attempts to achieve remote code execution, not just detect the vulnerability.

woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:194-305woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:430-434

Requirements

Target must have a vulnerable version of Product Slider Pro for WooCommerce plugin installed.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:111-115
Target must be a WordPress site.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:118-123

Observed behavior

Detects the presence and version of the Product Slider Pro for WooCommerce plugin by requesting readme.txt files.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:135-191
Sends GET and POST requests to known vulnerable endpoints (e.g., admin-ajax.php) with crafted parameters to trigger a remote payload download.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:194-305
Checks for suspicious files and directories that may indicate prior compromise.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:308-343

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url: Payload withheldTelegram contact link displayed in the banner and README of the PoC. This is author contact information and does not constitute a backdoor.CVE-2026-49777-CVE-2026-10735-xxconi/CVE-2026-49777.py:42CVE-2026-49777-CVE-2026-10735-xxconi/README.md:2
Url: Payload withheldA curl-to-bash command in the README instructs the operator to download and execute a script to 'clear nested dir .git'. This is a suspicious instruction, but the script content is not provided in the evidence, so its behavior cannot be confirmed as harmful.README.md:21
Command: Payload withheldThe README instructs the operator to pipe a remote script into bash. This is a high-risk operation, but without the script content, it cannot be classified as a trojan.README.md:21

Review boundaries

What the analysis did not establish

The evidence includes a second Python script (CVE-2026-49777-CVE-2026-10735-xxconi/CVE-2026-49777.py) that is a more comprehensive exploit with login bypass, REST API backdoor, and webshell RCE, but the primary artifact for classification is the one explicitly named for CVE-2026-49777.
The analysis is based solely on static code review; the code was not executed, and its effectiveness is not verified.
The artifact's behavior description is derived from its source code, not from observed runtime actions.
The curl-to-bash script referenced in README.md is not included in the evidence, so its behavior cannot be reviewed.
Five text files and one non-text file in the repository were omitted from the evidence packet; their content is unknown.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-10735

wpscan.comexploitvdb entryTechnical description

https://wpscan.com/vulnerability/160ee7f7-91b6-4cce-9462-837130621402

CVE-2026-10735

Record summary

Description

Exploitation context

Known exploitation

Available material

CISA SSVC decision

Affected products and versions

ShapedPlugin Pro

Product Slider for WooCommerce Pro

Real Testimonials Pro

smart-post-show-pro

Proofs of concept

Repository PoCs

Technical assessment

Backdoor review

Classification basis

Requirements

Observed behavior

Observables

Technical assessment

Backdoor review

Classification basis

Requirements

Observed behavior

Observables

References