Wordfence reports a ShapedPlugin Pro plugin supply-chain compromise through official licensed update channels. Inventory affected Pro plugins, remove unverified builds, scan the site, and rotate credentials where exposure is possible.