Attackers exploit Ninja Forms and WPC Product Bundles for WooCommerce flaws to backdoor WordPress sites and create hidden admin accounts

Updated: 2026.10.06 14D ago 1 sources

Zero-Days & CVEs Threat Actors & APTs Malware

Attackers are exploiting two WordPress plugin flaws to take over websites by planting backdoors and hidden administrator accounts. The bugs are stored cross-site scripting vulnerabilities CVE-2026-94504 in Ninja Forms 3.15.3 and older and CVE-2026-93836 in WPC Product Bundles for WooCommerce 8.6.6 and older. Malicious JavaScript placed in form submissions or WooCommerce order data runs when an admin views it, then installs a fake plugin, creates rogue admins, and sets up persistence including a secret login URL and unauthenticated file manager.

Why it matters: Sites using these plugins can be quietly taken over even after the obvious malicious plugin is removed, so affected administrators should update immediately and check for hidden accounts, unexpected plugins, and backdoors. This matters broadly to WordPress site owners, especially e-commerce operators using WooCommerce.

Sources

Ninja Forms plugin flaw exploited to hack WordPress sites

Bill Toulas 2026.10.06 100% relevant

This article establishes a new tracked story because it reports active exploitation of two specific WordPress plugin CVEs with a shared payload, concrete compromise behavior, and post-exploitation persistence details not represented in an existing tracked item.