Ninja Forms and WPC Product Bundles Flaws Exploited to Plant Hidden WordPress Admins

October 20, 2026

0

If your WordPress site has a contact form built with Ninja Forms, or a WooCommerce shop using WPC Product Bundles, this one is for you. Attackers are exploiting security holes in both plugins to sneak code into your site and wait for an administrator to look at it. When that happens, they quietly install a fake plugin and create admin accounts, including one that does not show up in your Users screen. Here is what happened and how to check your site.

What happened

WordPress security company Patchstack reported on October 6, 2026 that it had seen one attack campaign using two unrelated plugin flaws. It first spotted the attack on October 4 against WPC Product Bundles for WooCommerce (CVE-2026-93836), and the next day saw the same payload sent through Ninja Forms (CVE-2026-94504). Both are stored cross-site scripting (XSS) bugs with a CVSS score of 7.1, and both were publicly disclosed on September 22.

Stored XSS means the attacker saves malicious script inside your site's data. The attacker does not need an account. In WPC Product Bundles, the code goes into a quantity field and lands in WooCommerce order data. In Ninja Forms, it is sent as a normal form submission. Nothing happens until a logged-in administrator opens that order or form entry in the dashboard. Then the script loads from a domain called imgcdn1.com and runs with that admin's session.

What the attack does

The script does not steal your password or cookie. It simply uses your open admin session to click the buttons for you. Patchstack found that it installs a fake plugin called "WP Smart Thumbnails" version 1.2.4 by "MediaPress Labs" (folder name wp-smart-thumbnails) and leaves four separate ways back in:

A normal-looking new administrator account.
A second administrator that is hidden from Users, the Administrator filter and the user counts. It gets a routine name such as support, updater, maintenance or backup, and an @wordpress.org email address.
A secret login link that logs the holder in as the site's oldest administrator, which is usually the owner.
A file manager inside the fake plugin that needs no password at all.

The hidden account and secret login are kept alive by "must-use" plugins, which load automatically and never appear on the normal Plugins screen. The malware also backdates its files so they look older than WordPress itself. That means deleting the fake plugin, or looking for recently changed files, will not clean the site.

Who is affected

Ninja Forms is installed on more than 500,000 sites, and versions 3.15.3 and older are vulnerable. WPC Product Bundles for WooCommerce has more than 30,000 active installations, and versions 8.6.6 and older are vulnerable. Patchstack says exploitation volume is limited so far, but it expects more plugins to be added to the same campaign, because the attackers can reuse their payload with any stored XSS flaw.

What you should do

Update Ninja Forms to 3.15.4 or later and WPC Product Bundles to 8.6.7 or later. Ideally run the newest version of each.
Remember that updating stops new attacks but does not remove a backdoor that is already there. If an admin viewed form entries or orders while you were on an old version, check the site.
List your administrators straight from the database (phpMyAdmin or WP-CLI) and compare that list with what wp-admin shows. Any admin you can only see in the database is a red flag.
Look for the folder wp-content/plugins/wp-smart-thumbnails, and look in wp-content/mu-plugins for files named class-wp-token-validate.php or class-wp-query- followed by eight characters. Judge files by their contents, not their dates.
Ask your host to search your access logs for imgcdn1.com and for wp-login.php requests containing _wplogin.
If you find anything, remove the rogue accounts, files and the fz_emer_done_v1 and fz_emer_login_tokens options. Then change all admin passwords, especially the oldest admin account, and reset your WordPress security keys (salts).

The bigger lesson

Form entries and shop orders feel harmless, but they are data from strangers that you open while logged in as an admin. Keep form and e-commerce plugins updated quickly, limit how many people have administrator access, and use a separate lower-level account for day-to-day order handling if you can. Blocking the attacker's IP addresses will not help much, since Patchstack says most of them are Tor exit nodes.