Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two independent WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create fraudulent administrator accounts.
Both vulnerabilities were given a high severity rating and require an authenticated session to be exploited. They are tracked as CVE-2026-93836, affecting WPC product bundles for WooCommerce versions 8.6.6 and older, and CVE-2026-94504, affecting Ninja Forms versions 3.15.3 and older.
Installed on more than 500,000 websites, the Ninja Forms plugin for WordPress allows you to create custom forms without writing code.
WPC Product Bundles for WooCommerce allows you to store group products in bundles and is active on more than 30,000 WordPress sites.
The campaign was identified on October 4 by researchers at WordPress security platform Patchstack against users of WPC product bundles for WooCommerce. The next day, the same activity was observed against Ninja Forms.
Both attacks delivered the same JavaScript payload from imgcdn1(.)com, suggesting that the same threat actor is behind the exploitation attempts against the two plugins.
According to the researchers, the attacker is trying to inject malicious JavaScript (x.js) in WooCommerce order data or Ninja Forms submissions. When a logged in administrator loads the content, the script runs using the authenticated WordPress session.
When launched, it retrieves the necessary administrative nonces and uses legitimate WordPress functions to install a malicious plugin called “WP Smart Thumbnails” version 1.2.4 from “MediaPress Labs” and create an administrator account.
At this stage, the malicious plugin’s JavaScript payload and PHP scripts establish four access mechanisms to the compromised website:
- A visible administrator account
- An administrator account hidden from the WordPress user list in the dashboard
- A secret login URL that authenticates as the oldest existing administrator of the site
- An unauthenticated file manager that can be accessed via a direct request to the malicious plugin’s main PHP file
The file manager cannot execute commands, but could still be used to introduce additional payloads to the site.
Even if the WP Smart Thumbnails plugin is removed from the infected website, the hidden account and secret login URL continue to act as persistence mechanisms through separate additional attack plugins with backdated timestamps to evade detection.
“The (hidden) account does not appear under Users → All Users, does not appear in the admin filter, and is not counted in the totals above the list.” Patch stack explainedand added: “It is a fully privileged administrator that the site owner cannot see.”
Patchstack says the exploitation is currently limited, but recommends website administrators update to the latest versions of the affected plugins, WPC Product Packs for WooCommerce version 8.6.7 or later and Ninja Forms 3.15.4 or later.
Updating the vulnerable plugin will prevent further exploitation, but will not eliminate an existing infection. Administrators are strongly advised to look for signs of compromise.
