GoKawiilAttackers exploit Ninja Forms and WPC Product Bundles flaws to backdoor WordPress sites
Patchstack researchers found hackers exploiting stored XSS vulnerabilities in two unrelated WordPress plugins—Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836)—to plant backdoors and create rogue admin accounts. The campaign, first spotted October 4 against WPC Product Bundles users and a day later against Ninja Forms, injects a malicious script from 'imgcdn1[.]com' into order data or form submissions that executes when an administrator views it, installing a fake plugin disguised as 'WP Smart Thumbnails.'
GoKawiil's interpretation of the reporting above, not reported fact.
The shared payload source suggests, according to Patchstack, that a single threat actor is behind both exploitation efforts, highlighting how attackers can chain unrelated plugin flaws for broader impact. With Ninja Forms installed on over 500,000 sites and WPC Product Bundles on 30,000, the flaws could let attackers quietly maintain persistent access through hidden admin accounts and secret login URLs even after a surface-level cleanup.
- Two WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, have high-severity stored XSS flaws being actively exploited.
- Attackers use authenticated sessions to install a fake plugin and create concealed or alternate admin access points.
- Patchstack links both attacks to the same actor via a shared malicious script hosted on imgcdn1[.]com.
Source: bleepingcomputer.com, 2026-10-06
Published there as: “Ninja Forms plugin flaw exploited to hack WordPress sites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.