CVE-2026-49777

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

Published Jun 5, 2026 CVSS 3.1 · 10 Critical EPSS 1.7% KEV · Not listed

Description

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.

This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

Analysis

Technical impact

Improper validation of the specified quantity field in the plugin's input handling allows malicious software to be implanted. Based on the description, it is inferred that this vulnerability, identified as CWE‑1284, could enable an attacker to execute arbitrary code with the privileges of the web server, threatening the confidentiality, integrity, and availability of the WordPress site.

Affected Systems

All WordPress sites running ShapedPlugin, LLC’s Product Slider Pro for WooCommerce plugin versions before 3.5.4 are affected. The vendor has released version 3.5.4 which includes the fix.

Risk and Exploitability

The flaw has a CVSS score of 10, marking it as critical. With an EPSS score of 1% and not listed in CISA KEV, the likelihood of exploitation remains low, yet the potential impact remains high. Based on the description, it is inferred that the most likely attack vector is a crafted HTTP request to the plugin’s quantity handling endpoint, which could be triggered either by an authenticated user or by an unauthenticated visitor on a publicly accessible site.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ShapedPlugin, LLC

Product Slider Pro for WooCommerce

unaffected

Version	Status	Constraints
`n/a`	affected	< 3.5.4

No data.

Vendor Product Versions

Shapedplugin

Product Slider For Woocommerce

Version	Status	Scheme	Platform
`[0,3.5.3)`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

Vendor Solution

Update to 3.5.4 or a higher version.

OpenCVE Recommended Actions

Upgrade the Product Slider Pro for WooCommerce plugin to version 3.5.4 or a higher release.
Temporarily disable the Product Slider Pro for WooCommerce plugin until the patched files have been installed to block potential exploitation attempts.
Configure firewall or web‑application‑gateway rules to block or rate‑limit traffic to the plugin’s quantity endpoint until the fix is applied.

Generated by OpenCVE AI on June 18, 2026 at 07:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.7% (1.656% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability?_s_id=cve

History

Jun 8, 2026 5:00 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3. No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.	Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.
Title	WordPress Product Slider Pro for WooCommerce plugin < 3.5.3 - Backdoor vulnerability	WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

Jun 7, 2026 11:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Shapedplugin Shapedplugin product Slider For Woocommerce Wordpress Wordpress wordpress
Vendors & Products		Shapedplugin Shapedplugin product Slider For Woocommerce Wordpress Wordpress wordpress

Jun 6, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 5, 2026 9:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3. No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.
Title		WordPress Product Slider Pro for WooCommerce plugin < 3.5.3 - Backdoor vulnerability
Weaknesses		CWE-1284
References		https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`