GoKawiilAttackers exploit Ninja Forms and WPC Product Bundles flaws to backdoor WordPress sites
Patchstack researchers found hackers exploiting stored XSS vulnerabilities in two unrelated WordPress plugins—Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836)—to plant backdoors and create rogue admin accounts. The campaign, first spotted October 4 against WPC Product Bundles users and a day later against Ninja Forms, injects a malicious script from 'imgcdn1[.]com' into order data or form submissions that executes when an administrator views it, installing a fake plugin disguised as 'WP Smart Thumbnails.'