The WordPress Product Slider Pro for WooCommerce plugin contains an improper validation of the specified quantity field in its input handling, which permits the inclusion of malicious software through a backdoor. This defect corresponds to CWE‑1284 and allows an attacker to execute arbitrary code with the privileges of the web server, jeopardizing the confidentiality, integrity, and availability of the site.

All WordPress sites running ShapedPlugin, LLC’s Product Slider Pro for WooCommerce plugin versions older than 3.5.3 are affected. The vendor has applied an internal fix to the existing release but has not issued a new public version number, so the vulnerability remains present until the patched files are manually applied.

The flaw has a CVSS score of 10, marking it as critical. With no EPSS data available and it is not listed in CISA KEV, the likelihood of exploitation remains uncertain, yet the potential impact remains high. The most likely attack vector is a crafted HTTP request to the plugin’s quantity handling endpoint, which could be triggered either by an authenticated user or by an unauthenticated visitor on a publicly accessible site.