Cybercriminals compromised the update mechanism of the Smart Slider 3 Pro plugin for WordPress and Joomla, delivering a malicious update with a backdoor.

Patchstack, a WordPress security firm, reports that Smart Slider 3 Pro version 3.5.1.35 for WordPress is affected. Smart Slider 3 is a widely used WordPress plugin for creating sliders, boasting over 800,000 active installs across both the free and paid versions.

“An attacker managed to breach Nextend’s update system and distribute a completely malicious version through the official channels,” the company stated. “Any website updating to version 3.5.1.35 between April 7, 2026, when it was released, and approximately six hours later, when it was detected, received a comprehensive remote access toolkit.”

Nextend, the plugin’s developer, explained that an unauthorized individual gained access to their update infrastructure and pushed out a compromised version (3.5.1.35 Pro). This malicious version was available for roughly six hours before it was identified and taken down.

The compromised update allows the creation of fraudulent administrator accounts and installs backdoors enabling remote execution of system commands via HTTP headers and arbitrary PHP code through concealed request parameters. Patchstack highlights the following malicious functionalities:

• Achieving remote code execution without authentication via specific HTTP headers like X-Cache-Status and X-Cache-Key, where the latter contains code passed to “shell_exec().”
• A backdoor with two execution modes, enabling the attacker to execute both PHP code and OS commands on the server.
• Creating a hidden administrator account (e.g., “wpsvc_a3f1”) for ongoing access, concealed from legitimate administrators by manipulating the “pre_user_query” and “views_users” filters.
• Employing three customized WordPress options, with the “autoload” setting disabled to reduce visibility during option dumps: _wpc_ak (a secret authentication key), _wpc_uid (the user ID of the hidden administrator), and _wpc_uinfo (Base64-encoded JSON containing the username, password, and email address of the fraudulent account).
• Establishing persistence through three redundant methods: creating a must-use plugin named “object-cache-helper.php” to mimic a legitimate caching component, appending the backdoor code to the active theme’s “functions.php” file, and placing a file named “class-wp-locale-helper.php” within the WordPress “wp-includes” directory.
• Extracting sensitive information, including the site URL, the secret backdoor key, hostname, Smart Slider 3 version details, WordPress version information, PHP version details, the WordPress admin’s email, the WordPress database name, the administrator account’s username and password in plain text, and a list of all active persistence techniques to the command-and-control (C2) domain “wpjs1[.]com.”

“The malware functions in multiple stages, each intended to guarantee consistent, persistent, and redundant entry to the compromised site,” Patchstack explained.

“The complexity of the malicious code is significant. Rather than just a simple webshell, the attacker implemented a multilayered persistence mechanism with multiple independent entry points, user concealment tactics, resilient command execution with backup methods, and automatic C2 registration along with complete credential theft.”

The free version of the WordPress plugin remains unaffected. Nextend responded by taking its update servers offline, removing the malicious release, and initiating a thorough investigation.

Users with the infected version are urged to upgrade to version 3.5.1.36. Furthermore, those who have installed the compromised version are advised to follow these cleanup steps:

• Inspect for and eliminate any suspicious or unrecognized administrator accounts.
• Uninstall Smart Slider 3 Pro version 3.5.1.35, if installed.
• Reinstall a clean version of the plugin.
• Remove all persistence files that allow the backdoor to remain active on the website.
• Delete malicious WordPress options from the “wp_options” table: _wpc_ak, _wpc_uid, _wpc_uinfo, _perf_toolkit_source, and wp_page_for_privacy_policy_cache.
• Clean up the “wp-config.php” file, removing “define(‘WP_CACHE_SALT’, ‘<token>’);” if it exists.
• Remove the line “# WPCacheSalt <token>” from the “.htaccess” file located in the WordPress root directory.
• Reset passwords for the administrator and WordPress database users.
• Change login credentials for FTP/SSH and the hosting account.
• Examine logs and website for any unauthorized modifications and unexpected POST requests.
• Activate two-factor authentication (2FA) for administrators and disable PHP execution within the uploads directory.

“This incident represents a classic supply chain compromise, which bypasses conventional security measures,” Patchstack concluded. “Standard firewall rules, nonce checks, and role-based access controls are ineffective when malicious code is delivered via a trusted update channel. The plugin *is* the malware.”