Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers
The update system for the Smart Slider 3 Pro plugin for WordPress and Joomla has been taken over by unknown threat actors, who have used it to distribute a malicious version with a backdoor.
According to WordPress security firm Patchstack, the issue affects Smart Slider 3 Pro version 3.5.1.35 for WordPress. With over 800,000 active installations in both its free and Pro versions, Smart Slider 3 is a well-liked WordPress slider plugin.
According to Nextend, a fully attacker-authored build was sent via the official update channel after an unauthorized party got access to the company's update infrastructure. A fully armed remote access toolkit was sent to any site that updated to 3.5.1.35 between its release on April 7, 2026, and its discovery about six hours later.
The plugin's mai...