Ninja Forms plugin flaw exploited to hack WordPress sites

Security researchers at Patchstack have detected active exploitation of stored XSS flaws in two popular WordPress plugins—Ninja Forms and WPC Product Bundles for WooCommerce—to plant backdoors and hidden administrator accounts. The bugs, CVE-2026-94504 (Ninja Forms, versions 3.15.3 and earlier) and CVE-2026-93836 (WPC Product Bundles, versions 8.6.6 and earlier), both require an authenticated session but are being abused through the same malicious script served from imgcdn1[.]com, suggesting a single threat actor behind both campaigns. The attack injects JavaScript into form submissions or order data that, once viewed by a logged-in admin, installs a fake plugin disguised as "WP Smart Thumbnails" and creates a privileged admin account hidden from the normal WordPress user list, along with a secret login URL and an unauthenticated file manager for persistence. Even after the rogue plugin is deleted, these hidden access points can survive via auxiliary backdoor plugins with falsified timestamps, so site owners are urged to update to Ninja Forms 3.15.4+ or WPC Product Bundles 8.6.7+ and actively check for signs of prior compromise, since patching alone won't remove an existing infection.