Patchstack has published a technical analysis of a trojanized copy of WowShipping Pro 1.0.6, a commercial WooCommerce table rate shipping plugin sold by WPXPO. The practical problem is not just that one plugin version was dirty. According to Patchstack, the modified plugin acted as a dropper and installed a separate hidden malware plugin with remote access and credential-theft capabilities.
If your store used WowShipping Pro 1.0.6, this is worth treating as a possible compromise, not a normal plugin update chore.
Key Takeaways
- WowShipping Pro 1.0.6 is the version Patchstack analyzed as trojanized.
- Update WowShipping Pro to at least version 1.0.8.
- Updating alone does not remove malware that may already be installed.
- Check for the hidden WooCommerce Notifications malware plugin.
- If affected, review admin accounts, sessions, passwords, and 2FA secrets.
What the incident involves
WowShipping Pro is used to build WooCommerce shipping rules based on conditions such as weight, destination, quantity, product category, user role, and other store logic. Patchstack says the analyzed Pro package contained modified code in includes/class-plugin-actions.php.
The suspicious copy was reportedly traced from a compromised client site and submitted to Patchstack. Patchstack says forensic signs in the file suggested tampering, including style differences, missing documentation patterns, and code that used raw cURL and ZipArchive instead of the WordPress filesystem APIs used elsewhere in the plugin.
How the dropper worked
Patchstack says the malicious code registered on the admin_init hook, meaning it could run when an authenticated administrator loaded an admin page. It checked whether a plugin with the slug woocommerce-notifications existed. If not, it downloaded a ZIP file from a hardcoded attacker-controlled IP address, extracted it into wp-content/plugins/, activated it, and sent a beacon containing the victim site’s domain.
That fake WooCommerce Notifications plugin was the real payload. Nice name, terrible guest.
Why updating does not end the issue
WPXPO released WowShipping Pro versions 1.0.7 and 1.0.8 on March 22, 2026. Patchstack says version 1.0.8 no longer contains the dropper and advises users to be on at least that version.
But this is the uncomfortable part: updating WowShipping Pro does not remove malware that was already installed. If the dropper had already created and activated the hidden WooCommerce Notifications plugin, the site may still be compromised after the main plugin looks clean. That is why this needs inspection, not just an update button click.
What may have been compromised
Patchstack describes the installed malware as a multi-part remote access toolkit. It could hide itself from the normal WordPress plugins list, steal login credentials during authentication, collect cookies and user-agent data, and exfiltrate TOTP secrets from several WordPress 2FA plugins.
The named 2FA targets include WP-2FA, Wordfence Login Security, Really Simple SSL, and Two-Factor. In plain English: if the malware was active, two-factor authentication may not have saved the site. Attackers could potentially collect both the password and the secret needed to generate future 2FA codes.
What store owners should check now
- Check whether the site used WowShipping Pro 1.0.6.
- Update WowShipping Pro to at least version 1.0.8.
- Inspect the filesystem, not only the WordPress admin plugin screen, for a plugin folder named woocommerce-notifications.
- Review administrator users, active sessions, recently modified files, and suspicious plugin or mu-plugin entries.
- If exposure is likely, rotate admin passwords, invalidate sessions, review 2FA configuration, and follow Patchstack’s remediation guidance.
For a WooCommerce store, assume credentials and admin access are the main risk until proven otherwise.
What remains unclear
Patchstack says WPXPO emailed Pro customers on March 24 with a Security Update – Action Required message, but that email did not describe the malware, persistence risk, or cleanup steps. Patchstack also says WPXPO’s clean release, customer email, and private acknowledgement are consistent with a supply-chain incident.
The full scope is still not publicly clear from the source: which plugins were affected, the exact time window, and whether other WPXPO Pro plugins were involved have not been fully disclosed. For the technical details and remediation section, check the original Patchstack report: Supply Chain Compromise: Trojanized Copy of WowShipping Pro Installs Hidden Remote Access Toolkit.
Frequently Asked Questions
Was WowShipping Pro 1.0.6 infected with malware?
Patchstack analyzed a trojanized copy of WowShipping Pro 1.0.6 that contained a dropper. The dropper installed a hidden malware plugin named WooCommerce Notifications.
Which WowShipping Pro version should site owners use?
Patchstack says WowShipping Pro users should update to at least version 1.0.8. WPXPO released that version on March 22, 2026, and Patchstack says it does not contain the dropper.
Does updating WowShipping Pro remove the hidden malware plugin?
No. Patchstack says updating WowShipping Pro removes the dropper from the main plugin, but it does not remove malware that may already have been installed.
Why might WooCommerce Notifications not appear in the WordPress plugin list?
Patchstack says the malware plugin used code to hide itself from the normal WordPress plugins screen. Site owners should inspect the filesystem for a woocommerce-notifications plugin folder, not rely only on the admin plugin list.
Could 2FA still be bypassed if the malware was active?
Patchstack says the malware could steal TOTP secrets from WP-2FA, Wordfence Login Security, Really Simple SSL, and Two-Factor. If that happened, attackers could potentially have both the password and the secret needed to generate future 2FA codes.