Hackers are actively targeting a security issue in the Ninja Forms plugin for WordPress, alongside vulnerabilities found in another plugin, WPC Product Bundles for WooCommerce. This alarming trend highlights the danger posed by stored cross-site scripting (XSS) vulnerabilities, which allow cybercriminals to insert malicious code to take control of websites.
Details of the Vulnerabilities
Both vulnerabilities have been assigned high severity scores and necessitate an authenticated session for exploitation. Specifically, the first vulnerability is tracked as CVE-2026-94504, which affects Ninja Forms versions up to 3.15.3, and the second as CVE-2026-93836, impacting versions 8.6.6 and older of WPC Product Bundles for WooCommerce.
Plugin Popularity
The Ninja Forms plugin boasts a significant user base, being installed on over 500,000 WordPress sites. It enables users to design custom forms without needing to code. On the other hand, WPC Product Bundles for WooCommerce, which facilitates the creation of product bundles, is utilized on more than 30,000 sites.
Discovered Exploitation
The vulnerabilities were first identified by Patchstack, a security platform specializing in WordPress, on October 4. The following day, similar exploitation tactics were noted impacting the Ninja Forms plugin.
Both incidents involved a consistent JavaScript payload delivered from the domain ‘imgcdn1[.]com,’ suggesting a common threat actor is behind these attacks.
How the Exploitation Works
Attackers target WooCommerce order data and Ninja Forms submissions by injecting malicious JavaScript (referred to as x.js). When an administrator logged into the site accesses this content, the script executes, utilizing the authenticated session.
Once operational, the malicious script gathers necessary administrative nonces and exploits legitimate WordPress functions to install a deceptive plugin called “WP Smart Thumbnails” version 1.2.4 attributed to “MediaPress Labs.” This process leads to the creation of a rogue administrator account.
Compromise and Persistence
The malicious JavaScript and the harmful plugin establish multiple access points to the affected site:
- A visible administrator account
- An invisible admin account that doesn't appear in the user list
- A secret login URL for authentication as the original site admin
- An accessible file manager through direct access to the malicious plugin’s PHP file
Although the file manager cannot execute commands, it can still introduce additional malicious payloads to the site.
Crucially, removing the “WP Smart Thumbnails” plugin does not eliminate the hidden account or the secret URL, allowing attackers to maintain access even after the initial breach.
Response Recommendations
According to Patchstack, while the exploitation of these vulnerabilities is currently limited, it is important for site administrators to update their plugins to the most recent versions. Users should upgrade to WPC Product Bundles for WooCommerce version 8.6.7 or later and Ninja Forms version 3.15.4 or later.
Merely updating the plugins does not rectify existing infections, so thorough checks for signs of compromise are strongly recommended. Ensuring that your website’s security is up-to-date can help safeguard against future exploitation.
