News

Security researchers discovered that unknown intruders manipulated the update delivery system for the Smart Slider 3 Pro plugin used on WordPress and Joomla, distributing a malicious build that included a backdoor. The affected Pro release is version 3.5.1.35 for WordPress, and Patchstack - a WordPress security firm - identified the compromise. Smart Slider 3 is widely deployed, with more than 800,000 active installations across its free and Pro editions.

Nextend, the plugin’s maintainer, confirmed that an unauthorized actor accessed its update infrastructure and pushed an attacker-created package through the official update channel. The trojanized update went live on April 7, 2026, and remained available for roughly six hours before detection and removal. Any site that automatically updated to 3.5.1.35 during that window potentially received a fully weaponized remote access toolkit.

The malicious Pro build contains multiple mechanisms to secure long-term, stealthy access to compromised sites. It can create concealed administrator accounts and implant backdoors that permit remote command execution via HTTP headers as well as execution of arbitrary PHP code through hidden request parameters.

Patchstack detailed the technical capabilities of the payload, which include pre-authenticated remote code execution by abusing custom HTTP headers such as X-Cache-Status and X-Cache-Key; the latter is used to ferry code that the backdoor feeds into shell_exec(). The backdoor supports two execution paths, allowing the attacker to invoke both PHP code and operating-system-level commands on the server.

The attackers also implemented user-hiding techniques and persistent account creation. The trojan can add a hidden administrator account (for example, a username like "wpsvc_a3f1") and then alter WordPress filters such as pre_user_query and views_users so that legitimate administrators cannot see the rogue account.

To minimize detection in option dumps, the malware uses three custom WordPress options set with autoload disabled: _wpc_ak (a secret authentication key), _wpc_uid (the user ID for the hidden admin account), and _wpc_uinfo (a Base64-encoded JSON blob containing the plaintext username, password and email for that account). Additional indicator names include _perf_toolkit_source and wp_page_for_privacy_policy_cache, which should also be checked.

For redundancy, the implant installs persistence in multiple locations: it creates a must-use plugin file named object-cache-helper.php to masquerade as a caching helper, appends a backdoor routine to the active theme’s functions.php, and drops a file called class-wp-locale-helper.php inside the WordPress wp-includes directory. These multiple drop points give the attacker fallback access if one vector is discovered and removed.

The compromised plugin also collects a range of environment and credential data and sends it back to an attacker-controlled command-and-control domain, identified as “wpjs1[.]com”. Stolen data includes the site URL, the secret backdoor key, hostname, Smart Slider 3 and WordPress versions, PHP version, the site admin email, the WordPress database name, plaintext admin username and password, and a list of the persistence mechanisms discovered on the site.

Patchstack characterizes the payload as a layered persistence toolkit rather than a simple webshell. The attackers built multiple, independent re-entry points, implemented user concealment, provided resilient command execution with fallback chains, and automated registration with the C2 server alongside full credential exfiltration.

Important: the free version of Smart Slider 3 was not affected by this incident. In response, Nextend disabled its update servers, pulled the malicious 3.5.1.35 package, and opened a full investigation. The vendor and researchers recommend that anyone running the compromised Pro release upgrade immediately to version 3.5.1.36.

If you suspect your site updated to the trojanized release, perform the following cleanup steps without delay: check for any unfamiliar administrator accounts and delete them; remove Smart Slider 3 Pro v3.5.1.35 if present and reinstall a clean copy of the plugin; and delete all persistence files that the backdoor may have created.

Also inspect and remove malicious options from the wp_options table, including _wpc_ak, _wpc_uid, _wpc_uinfo, _perf_toolkit_source and wp_page_for_privacy_policy_cache. Examine wp-config.php for unexpected entries (for example, a line defining WP_CACHE_SALT with a token) and remove any such definitions. In the webroot .htaccess file, delete any line like “# WPCacheSalt <token>”.

Further recommended actions:

• reset administrator and WordPress database user passwords;
• change FTP, SSH and hosting control credentials;
• review application and server logs for unauthorized modifications and unusual POST requests;
• enable two-factor authentication for admin accounts;
• disable PHP execution in the uploads directory to limit future abuse.

Patchstack warned that this incident exemplifies a supply-chain compromise: when attackers deliver malicious code via a trusted update channel, conventional perimeter protections such as firewalls, nonce checks and role-based controls are bypassed because the malicious component arrives through a legitimate, signed update. In short, when the update itself is malicious, the plugin becomes the malware.