WordPress plugins Ninja Forms and WPC Product Bundles exploited by hackers

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue administrator accounts. The campaign, identified by Patchstack researchers, involves attackers planting malicious JavaScript within form submissions or WooCommerce order data.

When a logged-in administrator views the compromised content, the script executes using their authenticated session. This allows the attacker to install a malicious plugin masquerading as ‘WP Smart Thumbnails’ and establish multiple access mechanisms, including visible and concealed administrator accounts and secret login URLs. To evade detection, attackers have used backdated file timestamps on auxiliary plugins.

The vulnerabilities are tracked as CVE-2026-94504 (affecting Ninja Forms versions 3.15.3 and older) and CVE-2026-93836 (affecting WPC Product Bundles for WooCommerce versions 8.6.6 and older). The Uganda National CERT and Coordination Center advises administrators to update Ninja Forms to version 3.15.4 or later and WPC Product Bundles to 8.6.7 or later, while also auditing user lists for unauthorized accounts.