Hackers Exploit Flaws in Ninja Forms and WooCommerce Plugin

Hackers are exploiting stored cross-site scripting (XSS) flaws in two WordPress plugins to install backdoors and create unauthorized administrator accounts, according to security researchers at Patchstack.

The vulnerabilities affect WPC Product Bundles for WooCommerce, tracked as CVE-2026-93836, in versions 8.6.6 and older, and Ninja Forms, tracked as CVE-2026-94504, in versions 3.15.3 and older. Both flaws require an authenticated session and received high severity scores.

Patchstack identified activity targeting WPC Product Bundles on October 4, then observed the same activity against Ninja Forms the following day. The researchers said both attacks used the same JavaScript payload, delivered from “imgcdn1[.]com,” indicating a shared threat actor.

The payload is planted in WooCommerce order data or Ninja Forms submissions. When an administrator who is logged in loads the affected content, the script uses the active WordPress session to install a malicious plugin disguised as “WP Smart Thumbnails” version 1.2.4 from “MediaPress Labs” and create an administrator account. Patchstack says attackers also use additional mechanisms to maintain access, including a hidden account that does not appear in the WordPress user list.

Patchstack described exploitation as limited at the time of its report. It recommends upgrading WPC Product Bundles for WooCommerce to version 8.6.7 or later and Ninja Forms to version 3.15.4 or later. Updating blocks further exploitation but does not remove an existing infection.