Attackers are exploiting a Ninja Forms vulnerability and a separate flaw in WPC Product Bundles for WooCommerce to compromise WordPress websites. The campaign uses malicious JavaScript to install backdoors and create unauthorized administrator accounts, including one hidden from the dashboard.
Researchers at WordPress security company Patchstack detected attacks against WPC Product Bundles on October 4. The following day, they observed the same activity targeting Ninja Forms.
Both plugins received updates that address the vulnerabilities. However, installing those updates does not remove an infection already present on a website.
Two Plugins Affected by Stored XSS Flaws
The attacks exploit high-severity stored cross-site scripting vulnerabilities. Both require an authenticated session to exploit.
The Ninja Forms vulnerability, tracked as CVE-2026-94504, affects version 3.15.3 and earlier. Ninja Forms provides tools for building custom forms and has more than 500,000 active installations.
Meanwhile, CVE-2026-93836 affects WPC Product Bundles for WooCommerce version 8.6.6 and earlier. That plugin lets retailers group products into bundles and runs on more than 30,000 websites.
These installation figures describe the plugins’ reach, rather than the number of compromised sites. Patchstack says the observed exploitation remains limited.
Malicious Content Triggers Actions Through an Administrator’s Session
The attackers attempt to insert malicious JavaScript into WooCommerce order data or Ninja Forms submissions.
When a logged-in administrator views the affected content, the script runs through that administrator’s authenticated WordPress session. It then retrieves the security tokens needed to perform administrative actions.
Next, the payload uses legitimate WordPress functions to install a malicious plugin and create an administrator account.
The plugin disguises itself as “WP Smart Thumbnails” version 1.2.4 from “MediaPress Labs.” Both attacks delivered the same JavaScript payload from a shared domain, indicating a common operator behind the activity.
Attackers Establish Four Routes Back Into Compromised Sites
The malicious JavaScript and plugin components create several ways to retain access:
- A visible unauthorized administrator account.
- A second administrator account hidden from the WordPress dashboard’s user list.
- A secret login address that grants access as the site’s oldest existing administrator.
- A file manager that requires no authentication and is accessible through the malicious plugin.
The hidden account retains full administrator privileges. However, it does not appear in the dashboard’s complete user list, administrator filter or displayed user totals.
Although the file manager cannot execute commands directly, attackers can use it to place additional malicious files on the website.
Removing the Main Plugin Does Not Eliminate Every Backdoor
Deleting the fake WP Smart Thumbnails plugin does not necessarily end the compromise.
According to Patchstack, separate auxiliary plugins preserve the hidden administrator account and secret login mechanism. The attackers also give these components backdated timestamps to make them less conspicuous.
Consequently, removing the most visible malicious component can leave other access routes intact. A routine dashboard check may also miss the concealed administrator account.
Fixed Versions Address the Entry Points
Patchstack advises administrators to update Ninja Forms to version 3.15.4 or later. Websites using WPC Product Bundles for WooCommerce should install version 8.6.7 or later.
These releases address the vulnerabilities used in the campaign. However, they do not delete rogue accounts, malicious plugins or other persistence mechanisms from an already compromised installation.
Administrators should therefore check affected websites for signs of compromise alongside applying the updates. The distinction matters: patching closes the vulnerable entry point, while cleanup must address any access the attackers have already established.
0 responses to “Ninja Forms Vulnerability Exploited to Plant WordPress Backdoors”