CVE-2026-49777

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability?_s_id=cve

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-05 09:16

Updated : 2026-07-23 07:10

NVD link : CVE-2026-49777

Mitre link : CVE-2026-49777

CVE.ORG link : CVE-2026-49777

JSON object : View

Products Affected

No product.

CWE

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2026-49777", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49777", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-06T17:23:58.027774Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "audit@patchstack.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "audit@patchstack.com", "affectedData": [{"vendor": "ShapedPlugin, LLC", "product": "Product Slider Pro for WooCommerce", "versions": [{"status": "affected", "changes": [{"at": "3.5.4", "status": "unaffected"}], "version": "n/a", "lessThan": "3.5.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-05T09:16:26.220", "references": [{"url": "https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability?_s_id=cve", "source": "audit@patchstack.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "audit@patchstack.com", "description": [{"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.\n\nThis issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4."}, {"lang": "es", "value": "Vulnerabilidad de Validaci\u00f3n Incorrecta de Cantidad Especificada en la Entrada en ShapedPlugin, LLC Product Slider Pro para WooCommerce permite la implantaci\u00f3n de software malicioso.\n\nEste problema afecta a Product Slider Pro para WooCommerce: desde n/a antes de la 3.5.3.\n\nNo hay versi\u00f3n parcheada disponible - el proveedor ha aplicado una correcci\u00f3n a una versi\u00f3n existente sin publicar una nueva versi\u00f3n. Si bien el parche proporcionado por el proveedor es v\u00e1lido, publicarlo bajo el n\u00famero de versi\u00f3n existente deja a los usuarios incapaces de determinar de forma fiable si est\u00e1n ejecutando una instalaci\u00f3n parcheada o vulnerable. Como resultado, tratamos esto como una versi\u00f3n sin parche."}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "audit@patchstack.com"}