Ninja Forms and WPC Product Bundles for WooCommerce Plugins Vulnerable to Backdoor Installation and Rogue Admin Account Creation

Hackers are actively exploiting critical vulnerabilities in two widely used WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to compromise WordPress websites. The attacks, identified by security researchers, involve installing hidden backdoors and creating clandestine administrator accounts, effectively granting attackers persistent and undetectable access to victim sites. These sophisticated attacks pose a significant threat to website integrity and data security for hundreds of thousands of WordPress users.

The Nature of the Exploited Vulnerabilities

The exploited vulnerabilities are categorized as stored cross-site scripting (XSS) flaws. This type of vulnerability allows attackers to inject malicious scripts into a website’s content, which are then stored and can be executed by other users, particularly those with administrative privileges. In this specific campaign, the attackers leverage these XSS vulnerabilities to deliver a JavaScript payload.

The severity of these vulnerabilities has been rated as high. Exploitation requires an authenticated session, meaning an attacker must already have some level of access to the WordPress site, such as a compromised user account or the ability to submit data through the vulnerable plugins. This requirement, however, does not diminish the threat, as many attackers employ credential stuffing or brute-force attacks to gain initial access.

The vulnerabilities are officially tracked under the following identifiers:

• CVE-2026-93836: Affects WPC Product Bundles for WooCommerce versions 8.6.6 and older.
• CVE-2026-94504: Affects Ninja Forms versions 3.15.3 and older.

Plugin Popularity and Potential Reach

The widespread adoption of both vulnerable plugins amplifies the potential impact of these attacks.

• Ninja Forms is an exceptionally popular plugin, boasting over 500,000 active installations. Its primary function is to enable users to create custom forms on their WordPress websites without requiring any coding knowledge, making it a go-to solution for lead generation, contact forms, and data collection.
• WPC Product Bundles for WooCommerce is a vital extension for e-commerce sites running on the WooCommerce platform. It allows merchants to group multiple products into attractive bundles, a strategy often employed to increase average order value and enhance customer purchasing decisions. This plugin is active on more than 30,000 WordPress sites, primarily those engaged in online retail.

The significant user base of these plugins means that a large number of websites are potentially at risk. The ease with which these plugins allow users to add functionality without deep technical expertise also means that many site owners may not be fully aware of the security implications of outdated software.

Chronology of Discovery and Exploitation

The active exploitation of these vulnerabilities was brought to light by researchers at Patchstack, a dedicated WordPress security platform.

• October 4: Patchstack researchers first identified malicious activity targeting users of the WPC Product Bundles for WooCommerce plugin. The initial analysis pointed towards a coordinated exploitation attempt.
• October 5: The very next day, similar malicious activity was observed targeting the Ninja Forms plugin. This immediate correlation strongly suggested that the same threat actor was responsible for both attack campaigns.

The consistent pattern across both incidents, particularly the use of the same JavaScript payload, provided crucial evidence linking the two campaigns to a single malicious entity.

The Attack Mechanism: A Stealthy Infiltration

The sophistication of this attack lies in its method of payload delivery and persistence. According to Patchstack’s analysis, the attackers employ a multi-stage process:

1. Payload Delivery: The core of the attack begins with a JavaScript payload, identified as x.js, which is delivered from a suspicious domain, imgcdn1[.]com. This domain likely serves as a command-and-control server or a distribution point for the malicious code.

2. Injection into Legitimate Data: The attackers strategically plant this malicious JavaScript within seemingly innocuous data stored by the vulnerable plugins. Specifically, they target:

   • WooCommerce order data: For WPC Product Bundles for WooCommerce.
   • Ninja Forms submissions: For the Ninja Forms plugin.

3. Execution via Authenticated Sessions: The crucial trigger for the attack is when a logged-in administrator accesses the compromised content. When an administrator views an order containing the malicious script or a form submission with the injected code, the JavaScript executes within their authenticated WordPress session. This leverages the trust and permissions associated with the administrator’s account.

   

4. Gaining Elevated Privileges: Upon execution, the malicious script is designed to perform several critical actions:

   • Retrieve Administrative Nonces: Nonces (numbers used once) are security tokens used in WordPress to prevent cross-site request forgery (CSRF) attacks. By obtaining these, the attacker can make authorized requests on behalf of the administrator.
   • Install a Malicious Plugin: The script utilizes legitimate WordPress functions to download and install a plugin masquerading as "WP Smart Thumbnails" version 1.2.4, allegedly from "MediaPress Labs." This is a deceptive tactic, as the legitimate purpose of this plugin is to manipulate image thumbnails, but the malicious version serves as a backdoor.
   • Create a Rogue Administrator Account: Concurrently, the script creates a hidden administrator account. This account is specifically designed to be invisible to the website owner and standard WordPress administrative interfaces.

Persistent Access and Evasion Tactics

The threat actor has implemented robust measures to ensure persistent access to compromised websites, even if the initial malicious plugin is detected and removed. The attack establishes four distinct access mechanisms:

• Malicious Plugin (WP Smart Thumbnails): This serves as the primary backdoor, providing a direct entry point for the attacker.

• Hidden Administrator Account: This is a critical component of the persistence strategy. As described by Patchstack, this account is intentionally concealed:

  • It does not appear in the "Users > All Users" list.
  • It is not visible when filtering users by the "Administrator" role.
  • It is not included in the user count displayed above the user list.
  • This creates a "fully privileged administrator the site owner cannot see," offering a covert and powerful means of control.

• Secret Login URL: In addition to the hidden account, attackers often establish a secret URL that bypasses standard WordPress login pages, allowing direct access to the administrative dashboard using the compromised credentials or through a custom authentication mechanism.

• Auxiliary Attack Plugins: Even if the "WP Smart Thumbnails" plugin is removed, the attackers have further mechanisms to maintain their foothold. They deploy additional, less obvious plugins that function as secondary backdoors. These auxiliary plugins often feature backdated timestamps, a common evasion technique to blend in with legitimate plugins and avoid triggering security alerts based on recent activity.

The file manager functionality within the injected code, while unable to execute arbitrary commands directly, can still be used by attackers to upload additional malicious files or modify existing ones, further entrenching their presence on the server.

Broader Implications and Risks

The implications of such a successful compromise extend far beyond mere website disruption.

• Data Theft: Administrators often have access to sensitive customer data, financial information, and proprietary business details. A compromised administrator account can lead to the exfiltration of this critical data.
• Website Defacement and Manipulation: Attackers can alter website content, spread misinformation, or use the site to host phishing pages or distribute malware to visitors.
• Malware Distribution: Compromised WordPress sites are frequently used as distribution points for other malicious software, turning legitimate websites into vectors for further attacks.
• Reputational Damage: A security breach can severely damage a website owner’s reputation, leading to a loss of customer trust and business.
• Search Engine Penalties: Search engines like Google may penalize or delist websites found to be compromised or distributing malware, impacting organic traffic and visibility.
• E-commerce Fraud: For WooCommerce sites, a compromise can lead to fraudulent transactions, theft of payment card information, and severe financial losses for both the business and its customers.

Official Response and Mitigation Strategies

Patchstack has issued a strong advisory, urging immediate action from website administrators.

• Upgrade Vulnerable Plugins: The primary recommendation is to update both WPC Product Bundles for WooCommerce to version 8.6.7 or later, and Ninja Forms to version 3.15.4 or later. These updates are expected to contain patches for the identified vulnerabilities.

However, Patchstack emphasizes that updating the plugins only prevents further exploitation and does not automatically clean an existing infection.

• Proactive Security Audits: Administrators of sites running older versions of these plugins are strongly advised to perform thorough security audits to detect signs of compromise. This includes:
  • Reviewing user accounts for any unknown or suspicious administrators.
  • Checking for newly installed or unfamiliar plugins and themes.
  • Examining website files for unusual scripts or modifications.
  • Monitoring website traffic and performance for anomalies.
  • Consulting with cybersecurity professionals if a compromise is suspected.

While the current exploitation is noted as "limited" by Patchstack, the nature of the attack, which focuses on creating persistent, undetectable backdoors, means that even a small number of successful compromises can have significant long-term consequences. The attackers’ meticulous approach to evasion suggests a well-resourced and determined threat actor.

The WordPress security ecosystem relies on a collaborative effort between plugin developers, security researchers, and website administrators. This incident underscores the critical importance of prompt patching, regular security audits, and maintaining a vigilant approach to website security in the face of evolving cyber threats. The ability of attackers to exploit seemingly standard plugin functionalities for such insidious purposes highlights the need for continuous security awareness and proactive defense strategies within the WordPress community.