CVE-2026-94504

Imagine a suggestion box where someone slips in a note that, when the manager reads it, secretly hands over the office keys to the person who wrote it. That's what's happening here: an attacker submits a booby-trapped contact form, and when an admin opens that submission to review it, the trap springs and hijacks their login session. From there, the attacker can act as if they were the site owner.

This matters to you if your WordPress website uses the Ninja Forms contact form plugin, version 3.15.3 or earlier. No login is needed for the attacker to submit the malicious form — the trap is triggered only when an administrator opens the specific submission in the backend, so the risk depends on admins reviewing form entries, which is normal day-to-day plugin use.

Attackers are already actively exploiting this flaw in the wild as of early October 2026, using it to plant hidden backdoor admin accounts and malicious plugins on compromised sites. Because there is no official patch yet and exploitation is confirmed and ongoing, this requires immediate attention — don't wait for a fix before taking the protective steps available now.

Confirm exposure by checking the installed Ninja Forms version; any site running 3.15.3 or earlier is vulnerable. There is no vendor patch available at this time — monitor the WordPress.org plugin page and Patchstack advisories for a fixed release and apply it immediately once published. As a temporary workaround: restrict access to the legacy submission editor, train staff/admins not to open form submissions from the backend until patched, and consider a WAF rule to strip script tags from form text-field submissions. Given confirmed in-the-wild exploitation (Patchstack telemetry since 2026-10-05) matching the payload pattern from CVE-2026-93836, treat this as actively weaponized. Audit for compromise indicators: unexpected administrator accounts, unfamiliar installed plugins, and unauthorized file changes. This CVE is not currently in CISA's KEV catalog, so there is no federal remediation deadline, but the confirmed exploitation in the wild should override that absence in prioritization.

CVSS 7.2 (High) — CWE-79 stored cross-site scripting, network-exploitable, no authentication required, but requires an administrator to view the malicious submission (user interaction). Scope is changed (S:C) reflecting the admin-session takeover impact beyond the vulnerable component itself. No public exploit code has been published, but NEWS confirms active in-the-wild exploitation since 2026-10-05 using a payload consistent with CVE-2026-93836, used to deploy post-exploitation implants (hidden admin accounts, malicious plugins, persistence). Not listed in CISA KEV. No patch/fix is currently available from the vendor. Press attention is rising due to confirmed exploitation, not mere speculation.