CVE-2026-49777

This vulnerability lets a bad actor slip hidden, unauthorized functionality into your website through the plugin’s handling of a specific input. Think of it like a door on your storefront that looks normal, but someone found a way to smuggle in a “replacement lock” that they control. Once installed, it can allow malicious actions as if the attacker has access to parts of your site.

This matters to you if you run WordPress and have the plugin “ShapedPlugin, LLC Product Slider Pro for WooCommerce” installed. It affects versions before 3.5.4 (the issue is present from “n/a before 3.5.4”). If you don’t use this plugin, you are not affected by this specific CVE.

This is RED urgency because it is considered critical and press reports indicate it is being exploited in the wild (itw). Even though CISA has not listed it in its KEV catalog and there is no public exploit or detection template noted here, the fact that real attacks are happening means you shouldn’t wait. Treat this as an immediate “patch now and check for signs of compromise” situation.