Threat actors are leveraging stored cross-site scripting (XSS) weaknesses in Ninja Forms and WPC Product Bundles for WooCommerce to deliver backdoors and establish unauthorized administrative access on compromised WordPress installations.

Both flaws carry high severity ratings and demand an authenticated user session to trigger. The vulnerabilities are designated CVE-2026-93836 for WPC Product Bundles for WooCommerce affecting versions 8.6.6 and earlier, and CVE-2026-94504 for Ninja Forms impacting versions 3.15.3 and earlier.

Ninja Forms, deployed across more than 500,000 WordPress sites, enables users to build custom forms without coding. WPC Product Bundles for WooCommerce, active on over 30,000 sites, facilitates grouping products into bundled offerings.

Security researchers at Patchstack detected the campaign targeting WPC Product Bundles for WooCommerce on October 4, followed by similar activity against Ninja Forms the following day. Both attack waves delivered identical JavaScript payloads originating from 'imgcdn1[.]com,' suggesting a single threat actor conducting both exploitation efforts.

Attack mechanism and persistence

The attacker injects malicious JavaScript (x.js) into WooCommerce order records or Ninja Forms submission data. Upon loading this content, a logged-in site administrator unwittingly executes the script within their authenticated WordPress session.

The payload retrieves WordPress administrative nonces and leverages built-in WordPress functions to deploy a malicious plugin disguised as "WP Smart Thumbnails" version 1.2.4 from "MediaPress Labs" and establish a new administrator account.

This foothold creates four distinct access pathways to the compromised site:

  1. A standard administrator account visible in the WordPress dashboard
  2. An administrator account hidden from the WordPress user list and administrator filter
  3. A covert login URL that authenticates as the site's oldest administrator without requiring credentials
  4. An unauthenticated file manager accessible via direct requests to the malicious plugin's main PHP file

While the file manager lacks command execution capabilities, it can serve as a vector for introducing additional malicious code to the site.

Removal of the WP Smart Thumbnails plugin does not eliminate the threat. The hidden account and secret login URL persist through separate auxiliary plugins with backdated timestamps designed to evade detection.

The [hidden] account does not appear in Users → All Users, does not appear in the Administrator filter, and is not counted in the totals above the list. It is a fully privileged administrator the site owner cannot see.

Patchstack

Remediation guidance

While exploitation remains limited in scope, Patchstack urges WordPress administrators to update to patched versions: WPC Product Bundles for WooCommerce 8.6.7 or later and Ninja Forms 3.15.4 or later.

Upgrading the vulnerable plugins prevents new exploitation but does not remove existing infections. Site owners should conduct thorough forensic reviews to identify any signs of prior compromise.