ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Description

Multiple ShapedPlugin Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Confirmed malicious builds: Smart Post Show Pro 4.0.1, Product Slider for WooCommerce Pro 3.5.2, and Real Testimonials Pro 3.2.4, each pulled by the vendor and superseded by a clean release. However, there hasn't been any public statement from the vendor, who ghosted us after reporting the issue to them.

Indicators of compromise:
- C2 / dropper host: 194.76.217.28:2871
- Beacon: POST http://194.76.217.28:2871/api.php
- Dropper URL: http://194.76.217.28:2871/files/woocommerce-subscription.zip
- Persistent stage filename: wp-content/plugins/woocommerce-subscription/install-persistent.php
- Malicious file in primary build: includes/class-smart-show-pro-installer.php