WordPress plugins exploited to create hidden administrators

A cyberattack campaign is targeting WordPress websites by exploiting vulnerabilities in two popular plugins: WPC Product Bundles for WooCommerce and Ninja Forms. According to documentation from Patchstack, attackers are using these flaws to install malicious code, create hidden administrator accounts that do not appear in standard user lists, and establish persistence mechanisms to maintain access even after the initial vulnerabilities are patched.

The campaign involves two specific vulnerabilities. The first, CVE-2026-93836, is a stored cross-site scripting (XSS) flaw in WPC Product Bundles (fixed in version 8.6.7). The second, CVE-2026-94504, affects Ninja Forms (fixed in version 3.15.4). Experts warn that simply updating the plugins may not be sufficient to secure a site, as attackers may have already created backdoors within the installation.

While WordPress core is highly scrutinized and frequently patched, security experts note that the vast majority of vulnerabilities—over 90%—originate from poorly written third-party plugins and themes rather than the core software itself. Maintaining secure hosting environments and vetting plugin quality remain critical for site administrators.