CVE-2026-49777: WordPress Product Slider Pro for WooCommerce plugin < 3.5.3 - Backdoor vulnerability

Synopsis

A backdoor-class vulnerability (improper input quantity validation enabling malicious software implantation) affects ShapedPlugin LLC's Product Slider Pro for WooCommerce plugin in all versions before 3.5.3. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation allows an attacker to implant malicious code, giving full read, write, and denial-of-service capability over the affected environment. Note: the vendor applied a fix silently under the existing version number rather than publishing a new release, meaning version numbers alone cannot confirm whether a running installation is patched; HarborGuard tracks this advisory and will reflect patch availability as it becomes reliably verifiable.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is exposed over the network (AV:N), meaning an attacker must be able to reach the WordPress/WooCommerce HTTP endpoint to exploit it.

• AuthenticationNot required

  No credentials or account of any privilege level are needed (PR:N); the exploit is available to any unauthenticated remote party.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required (UI:N); the attacker triggers exploitation entirely on their own.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and repeatable without needing to meet special conditions, race timing, or specific memory layout.

Blast Radius

• An attacker implants arbitrary malicious code (backdoor software) directly into the WordPress installation, gaining persistent execution capability on the host.
• Full confidentiality impact (C:H with scope change S:C) means the attacker reads any data accessible to the web server process, including database credentials, session tokens, customer order records, and payment metadata stored or accessible by WooCommerce.
• Full integrity impact (I:H with scope change) means the attacker modifies any data the web server process can write, including product listings, order records, user accounts, and plugin files across the WordPress installation.
• Full availability impact (A:H with scope change) means the attacker disrupts or completely crashes the affected service, taking down the storefront and any co-hosted workloads reachable from the compromised process.