A WordPress Plugin Used on 800,000 Sites Had Its Update System Hijacked. For Six Hours, Every Site That Clicked "Update" Installed a Fully Weaponized Remote Access Toolkit. The Plugin Was the Malware.

WHAT HAPPENED

On April 7, an unauthorized party gained access to Nextend's update infrastructure and distributed a fully attacker-authored build of Smart Slider 3 Pro through the official update channel. Smart Slider 3 is a popular WordPress slider plugin used on over 800,000 websites for creating responsive sliders. The malicious version, 3.5.1.35, was available for approximately six hours before Nextend detected and pulled it.

During that window, any WordPress or Joomla site with automatic updates enabled or where an admin manually clicked "Update Plugin" received a package that was not a plugin at all. It was a fully weaponized remote access toolkit designed for deep, persistent, and redundant access to the compromised site. The legitimate plugin functionality was preserved so nothing looked wrong on the surface. The backdoor ran silently alongside the slider features the admin expected to see.

This came one week after CVE-2026-3098, a separate arbitrary file read vulnerability in the same plugin that allowed authenticated users to download wp-config.php from affected sites. The fix for that vulnerability was to update to version 3.5.1.34. Anyone who updated again to the next version, 3.5.1.35, went from patching one vulnerability to installing a complete compromise. The irony is brutal. The responsible action of keeping your plugins updated was the attack vector.

WHAT THE MALWARE DID

Patchstack's analysis describes a multi-stage payload designed for maximum persistence. This was not a simple webshell. Every layer was built to ensure the attacker could get back in even if one access path was discovered and removed.

The malware first created a hidden administrator account with the email prefix "wpsvc_" and concealed it from the WordPress admin user interface. You could log into your dashboard, look at your user list, and never see it. It then installed backdoors in at least five separate locations: the plugin's main file, a must-use plugin disguised as a caching component (object-cache-helper.php), the active theme's functions.php file, a file dropped into the wp-includes directory (class-wp-locale-helper.php), and modifications to wp-config.php.

The must-use plugin path is particularly effective. Must-use plugins in WordPress load automatically on every page request, cannot be disabled from the dashboard, and are not visible in the standard plugins section. The wp-config.php persistence is even worse. The malware injected code that runs before WordPress itself fully initializes, meaning it persists even if WordPress fails to bootstrap completely. Removing the plugin does not remove the backdoor.

The toolkit then exfiltrated a full credential package to the C2 domain wpjs1[.]com: site URL, backdoor key, hostname, plugin version, WordPress version, PHP version, admin email, database name, plaintext admin username and password, and a complete inventory of all installed persistence methods. The attacker not only compromised the site. They gave themselves a map of exactly how they compromised it and how to get back in through each path.

ATTACK CHAIN

WHY TRADITIONAL SECURITY DID NOT HELP

Patchstack's conclusion on this incident is worth quoting directly: "This incident is a textbook supply chain compromise, the kind that renders traditional perimeter defenses irrelevant. Generic firewall rules, nonce verification, role-based access controls, none of them apply when the malicious code is delivered through the trusted update channel. The plugin is the malware."

That last line captures why supply chain attacks are fundamentally different from every other category of vulnerability. A SQL injection gives an attacker a way in through a gap in your code. A supply chain compromise turns your own trusted update process into the delivery mechanism. The admin who clicked "Update" did exactly what they were supposed to do. They followed best practices. They kept their plugins current. And that responsible action installed a remote access toolkit with five independent persistence layers.

This is the same pattern we have been tracking all year. On March 25, we covered the TeamPCP supply chain cascade that compromised Trivy, Checkmarx, and LiteLLM through poisoned packages. On March 31, we covered the Axios npm supply chain attack where North Korea's UNC1069 compromised one of the most downloaded packages on the internet. The attack vector is the same every time: compromise the distribution infrastructure that developers and administrators trust, and let the target install your malware for you.

INDICATORS OF COMPROMISE

DEFENSE TAKEAWAYS