WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
CVE-2026-49777
Verified
Description
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.
Severity
Critical
CVSS Score
10
Exploit Probability
2%
Affected Product
product_slider_pro_for_woocommerce
Published Date
June 9, 2026
Template Author
dhiyaneshdk
CVE-2026-49777.yaml
10.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-49777
CWE ID:
cwe-506
References
https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerabilityhttps://patchstack.com/articles/critical-supply-chain-compromise-in-smart-slider-3-pro-full-malware-analysis/https://nvd.nist.gov/vuln/detail/CVE-2026-49777
Remediation Steps
Apply the vendor's patch or update to the latest fixed version when available.