Smart Slider 3 Pro Supply Chain Attack Backdoors 900,000 WordPress and Joomla Sites

On April 7, attackers breached Nextend’s update distribution infrastructure and pushed a fully weaponized build of Smart Slider 3 Pro — version 3.5.1.35 — to over 900,000 active WordPress and Joomla installations. The malicious update was live for approximately six hours before detection. The free edition was unaffected; only Pro license holders received the poisoned package.

The trojanized build was not a simple backdoor. It deployed four independent persistence layers simultaneously: a must-use plugin disguised as a caching component, a backdoor injected into the active theme’s functions.php, a rogue PHP file planted inside wp-includes impersonating a core WordPress class, and a .cache_key file capable of executing code even if WordPress failed to fully bootstrap. Any single layer surviving cleanup would re-establish attacker access.

The initial entry point was unauthenticated remote code execution triggered via crafted HTTP request headers — specifically X-Cache-Status and X-Cache-Key. Once in, the malware created a hidden administrator account named wpsvc_a3f1 and exfiltrated site credentials — plaintext WordPress admin username and password, database name, and PHP and WordPress version strings — to the C2 domain wpjs1[.]com.

Patchstack researchers discovered and documented the compromise. Nextend pushed a clean build, version 3.5.1.36, within hours of detection.

What you need to do if you run Smart Slider 3 Pro:

1. Update immediately to version 3.5.1.36 or later.
2. Purge the following database options: _wpc_ak, _wpc_uid, and _wpc_uinfo.
3. Scan and delete any rogue files injected into wp-includes and your active theme’s functions.php.
4. Search for and remove the must-use plugin added by the malware.
5. Rotate all credentials: WordPress admin passwords, database passwords, and any API keys stored in the environment.
6. Enable two-factor authentication on all admin accounts.

If version 3.5.1.35 was installed at any point — even briefly — treat the site as fully compromised. The credential exfiltration alone means attackers have everything they need for persistent access even if the PHP backdoors are removed.

Supply chain attacks against WordPress plugin vendors are not new, but this one is notable for its operational sophistication. Four redundant persistence mechanisms is not the work of a script kiddie; it reflects attackers who anticipated cleanup attempts and built redundancy into the payload from the start.

Nextend has not published a detailed post-mortem on how its update server was accessed. For a plugin with nearly a million active installs, that disclosure matters. Site owners deserve to know whether this was a compromised credential, a vulnerable deployment pipeline, or something deeper in their infrastructure.

Until Nextend publishes a root-cause analysis, treat this as an ongoing threat and audit any site that ran the affected version.