WordPress supply chain attack on Smart Slider 3 Pro pushed a 6-stage backdoor to up to 900K sites within 6 hours on April 7, with a full recovery guide provided.

WordPress Supply Chain Attack Hits 900K Sites in 6 Hours

by
💡 Key Takeaways

  • Smart Slider 3 Pro’s official update channel was hijacked on April 7, pushing a 6-stage backdoor to 800K–900K active WordPress and Joomla installations
  • The malware features pre-authentication remote code execution, hidden admin accounts, triple-layer persistence, and automated C2 registration with plaintext credential exfiltration
  • WordPress supply chain attacks are accelerating in 2026 — Gravity Forms suffered a similar breach, and weekly plugin vulnerabilities hit 333 with 236 unpatched

Six hours. That is how long it took for the most sophisticated WordPress supply chain attack on record to unfold and get shut down. On April 7, hackers compromised the update infrastructure of Smart Slider 3 Pro — a popular slider plugin with 800,000 to 900,000 active installations — and pushed a weaponized build through the official distribution channel.

This was not a run-of-the-mill vulnerability exploit. Firewalls, access controls, authentication systems — every defensive layer a diligent site administrator had in place became irrelevant the moment the plugin itself turned into malware. The trusted update mechanism was the attack vector.

The implications extend far beyond a single plugin. WordPress powers 43% of all websites globally, and 90% of successful attacks on the platform come through plugins. When the supply chain itself is compromised, the very act of keeping software up to date becomes the point of entry.

The Timeline: 6 Hours From Deployment to Detection

The attack began with the compromise of Nextend’s update infrastructure. Attackers gained access to the Smart Slider 3 Pro distribution servers and swapped the legitimate build with a trojanized version numbered 3.5.1.35. The malicious update was then delivered through the official channel — indistinguishable from any routine patch.

WordPress and Joomla sites configured for automatic updates began pulling the infected package immediately. For approximately six hours, every Pro user who triggered an update received a fully weaponized remote access toolkit instead of a security patch.

Security firm Patchstack detected the anomaly and flagged the compromised build. Nextend pulled the malicious version and issued a clean release, version 3.5.1.36, within hours of detection. Free edition users were unaffected — only the paid Pro version was targeted.

Cybersecurity illustration depicting a WordPress supply chain attack with shattered digital defenses (AI-generated)
The Smart Slider 3 Pro supply chain attack turned a trusted update channel into a six-stage weapon — Generated by OpenAI DALL-E 3 (AI-generated)

Six-Stage Malware: Anatomy of the Attack

Patchstack’s full malware analysis revealed a six-stage attack architecture designed for depth, redundancy, and stealth. Each stage serves a distinct purpose, and together they form one of the most layered plugin compromises ever documented.

Stage 1 — Pre-Authentication Remote Code Execution. The malware executes on every page load, checking the HTTP header X-Cache-Status for a specific key value. When the key matches, the attacker’s payload is passed directly to shell_exec(), granting unauthenticated command execution — no login credentials are required.

Stage 2 — Authenticated Backdoor with Dual Modes. A second backdoor operates behind a secret key stored in the WordPress database. It supports two execution modes: PHP eval for arbitrary code execution and OS command execution through a six-function fallback chain — shell_exec, exec, system, passthru, proc_open, and popen — automatically cycling to the next if one is disabled by the hosting environment.

Stage 3 — Hidden Administrator Account. The malware creates a rogue WordPress admin with a username pattern of ‘wpsvc_’ followed by a four-character hash, using the email address kiziltxt2@gmail.com. Stage 4 then deploys two WordPress filters — one modifying admin user queries to exclude the hidden account, the other adjusting role count badges — making the rogue user completely invisible in the dashboard.

Stage 5 — Triple-Layer Persistence. Three independent backdoors ensure the attacker can re-enter even after the plugin is removed: one hides in the mu-plugins directory as object-cache-helper.php (auto-loaded on every request), another injects code into the active theme’s functions.php, and a third drops class-wp-locale-helper.php into wp-includes, mimicking a legitimate WordPress core class.

Stage 6 — C2 Registration and Credential Exfiltration. The malware transmits a JSON payload to its command-and-control server containing the site URL, admin email, database name, and plaintext credentials for the hidden account. The connection uses sslverify: false, bypassing certificate validation to evade network-level detection.

In simpler terms: This malware does not just open the front door — it simultaneously unlocks the back door, the basement entrance, and every window. Removing one access point leaves the others intact.

Why 900K Sites Were Exposed: WordPress’s Structural Vulnerability

The scale of this breach is inseparable from WordPress’s dominance. The platform powers 43% of all websites on the internet, and its plugin ecosystem is the primary attack surface. Nine out of ten successful WordPress hacks come through plugins or add-ons — not through the core platform itself.

The numbers paint a sobering picture of the ecosystem’s fragility. In a single week in January 2026, 333 new WordPress vulnerabilities were reported — 253 in plugins and 80 in themes — with 236 remaining unpatched at the time of disclosure. The plugin ecosystem operates at a pace that outstrips its security infrastructure.

The key here is that this WordPress supply chain attack was not a vulnerability exploit in the traditional sense. There was no CVE to patch, no misconfiguration to fix. The attacker compromised the distribution infrastructure itself, meaning the official update channel became the delivery mechanism for malware.

Site administrators who followed security best practices to the letter — keeping plugins updated, running firewalls, enforcing strong passwords — were the ones most likely to be compromised. The update itself was the infection vector. Diligence became a liability.

Key point: 90% of WordPress hacks come through plugins. Weekly vulnerabilities hit 333 with 236 unpatched. Supply chain attacks bypass every traditional defense by weaponizing the trust model itself.
Digital security panel representing cybersecurity infrastructure
WordPress’s plugin ecosystem is the platform’s greatest strength and its most exploitable weakness — Photo by Adi Goldstein on Unsplash

“The Plugin Is the Malware” — Patchstack’s Warning

Patchstack’s analysis cut straight to the structural problem. “This is a textbook supply chain compromise — firewalls, nonce verification, and role-based access controls all become irrelevant when malicious code is delivered through the trusted update channel. The plugin is the malware.”

That assessment exposes a fundamental assumption baked into WordPress security architecture. Traditional defenses — web application firewalls (WAFs), nonce token verification, and role-based access control (RBAC, systems that restrict access based on user roles) — are designed to block external-to-internal attacks. The WordPress supply chain attack inverts that model entirely.

Smart Slider is not an isolated case. Gravity Forms, a premium form builder plugin with approximately one million active installations, was also compromised through a similar vector in 2026. Attackers gained access to the vendor’s infrastructure and injected backdoors into the official manual installer available on the company’s website.

Patchstack described the malware’s architecture in unambiguous terms. “The malware operates in several stages, each designed to ensure deep, persistent, and redundant access to the compromised site,” the firm’s analysis stated. The use of sslverify: false for C2 communication — bypassing certificate validation — demonstrates how far attackers went to evade detection.

💡 Related Posts
Open-Source AI Beats GPT-5.4: GLM-5.1’s 8-Hour Coding Feat

Infection Check: How to Know If Your Site Was Compromised

Any site that installed Smart Slider 3 Pro version 3.5.1.35 should be treated as potentially compromised. Patchstack published a comprehensive set of Indicators of Compromise (IoCs) that administrators can use to determine whether the malware was deployed. The check covers three areas, starting with file system artifacts.

  • wp-content/mu-plugins/object-cache-helper.php — a must-use plugin backdoor disguised as a caching component
  • wp-includes/class-wp-locale-helper.php — a core directory backdoor mimicking a legitimate WordPress class
  • wp-includes/.cache_key — an authentication key file that survives database credential changes
  • The active theme’s functions.php containing the string _wpc_ak

Database indicators: Check the wp_options table for three entries — _wpc_ak (the malware’s authentication key), _wpc_uid (the hidden user’s ID), and _wpc_uinfo (base64-encoded credentials for the rogue account). All three are configured with autoload set to false to minimize visibility.

User account indicators: Search for any administrator account with a username starting with ‘wpsvc_’ or registered under the email kiziltxt2@gmail.com. The display name will read “WordPress Service.” Because the malware’s Stage 4 user concealment filters hide this account from the admin dashboard, a direct database query is the only reliable detection method.

Laptop displaying a WordPress dashboard interface
The malware’s user concealment filters make the rogue admin account invisible in the WordPress dashboard — only direct database queries can detect it — Photo by Deng Xiang on Unsplash

Emergency Response: 6-Step Recovery Guide for Infected Sites

Updating to version 3.5.1.36 alone does not secure a compromised site. The triple-layer persistence mechanism plants independent backdoors outside the plugin directory — in mu-plugins, the active theme, and WordPress core files. A full incident response procedure is required, following these six steps.

  • Step 1: Restore from a backup dated April 5 or earlier (a safety margin accounting for time zone differences across the initial deployment window)
  • Step 2: Perform a clean reinstall of WordPress core, all plugins, and all themes from verified sources
  • Step 3: Update Smart Slider 3 Pro to version 3.5.1.36 or later
  • Step 4: Manually delete the malicious user account, all identified backdoor files, and the three database option entries (_wpc_ak, _wpc_uid, _wpc_uinfo)
  • Step 5: Rotate every credential — WordPress admin passwords, database credentials, FTP/SSH keys, hosting panel logins, and associated email accounts
  • Step 6: Regenerate WordPress security keys (salts) and enable two-factor authentication (2FA) across all admin accounts

The takeaway: infected sites require a rebuild, not a patch. The malware’s Stage 6 already transmitted plaintext credentials to the C2 server. Without a complete credential rotation, removing the backdoor files leaves the door open for re-entry using the exfiltrated passwords.

Administrators who lack a pre-April 5 backup face a harder path — a manual forensic audit of every file, database entry, and user account against Patchstack’s IoC list. For sites handling sensitive data, engaging a professional incident response team is the prudent course.

Key point: A simple update does not restore security. The minimum response is backup restoration to April 5 or earlier, a clean reinstall, and full credential rotation across every access point.

Supply Chain Attacks Escalate in 2026: Who’s Next?

Smart Slider 3 Pro (800K–900K installations) and Gravity Forms (approximately 1 million installations) represent a pattern, not a pair of isolated incidents. Both attacks targeted plugin vendor infrastructure directly — compromising the distribution pipeline rather than exploiting code vulnerabilities. The playbook is the same; only the target changes.

The structural weakness is WordPress’s automatic update dependency model. Hundreds of thousands of sites implicitly trust vendor distribution servers with no code signing verification, no cryptographic integrity checks, and no independent validation layer between the vendor’s build system and the production site. In Patchstack’s framing, “traditional perimeter defenses become irrelevant” under these conditions.

Two indicators deserve close monitoring in the weeks ahead. The first is whether WordPress’s core team accelerates discussion of plugin code signing — a cryptographic mechanism that would allow sites to verify that an update was actually built by the vendor. The second is whether additional supply chain breaches surface, given that the attack methodology has now been demonstrated twice in 2026.

The WordPress supply chain attack on Smart Slider 3 Pro is not a story about one plugin’s security failure. It is a stress test of the trust model that underpins 43% of the web. The six-hour window was narrow, but the architectural questions it exposed are wide open.

💡 Related Posts
28 Cities in Decline: The Great US Housing Reversal

References

Stay Ahead of the Curve

Get the latest insights on AI, tech, and markets — delivered in both Korean and English.

Explore More Posts