Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are exploiting stored XSS vulnerabilities tracked as CVE-2026-94504 (Ninja Forms) and CVE-2026-93836 (WPC Product Bundles for WooCommerce) to deliver malicious JavaScript payloads via form submissions or WooCommerce order data. The payload executes in the context of logged-in administrators, retrieves administrative nonces, and uses legitimate WordPress functions to install a malicious plugin named “WP Smart Thumbnails” version 1.2.4. This plugin creates multiple backdoors including visible and hidden administrator accounts, a secret login URL authenticating as the oldest admin, and an unauthenticated file manager. The hidden admin account is not visible in the WordPress user list or admin filters, enabling persistent unauthorized access. The malicious plugin and auxiliary backdoor plugins use backdated timestamps to evade detection. Exploitation requires an authenticated session and is currently limited. The vulnerabilities affect Ninja Forms versions 3.15.3 and older and WPC Product Bundles for WooCommerce versions 8.6.6 and older. Patchstack researchers identified the campaign in early October 2026. Upgrading to Ninja Forms 3.15.4 or later and WPC Product Bundles 8.6.7 or later prevents further exploitation but does not remove existing backdoors.

Successful exploitation allows attackers to install persistent backdoors on WordPress sites, including hidden administrator accounts and secret login mechanisms, enabling full site compromise. Attackers can maintain long-term unauthorized access even after removal of the malicious plugin. The unauthenticated file manager allows uploading additional payloads, increasing the risk of further compromise. The vulnerabilities require an authenticated session, limiting exploitation to users with some level of access, but the impact is severe due to the persistence and stealth of the backdoors.

Site administrators should immediately upgrade Ninja Forms to version 3.15.4 or later and WPC Product Bundles for WooCommerce to version 8.6.7 or later to prevent further exploitation. These updates address the stored XSS vulnerabilities. However, updating does not remove existing infections; administrators must manually inspect for and remove malicious plugins, hidden administrator accounts, secret login URLs, and other backdoors. Monitoring for unusual administrator accounts and unauthorized plugins is recommended. Follow vendor advisories and Patchstack guidance for detailed cleanup procedures.