Ninja Forms + WPC Product Bundles Flaws Actively Exploited

Attackers are actively exploiting stored cross-site scripting flaws in two widely used WordPress plugins — Ninja Forms and WPC Product Bundles for WooCommerce — to plant backdoors, install malicious plugins, and create hidden administrator accounts. The campaign, identified by researchers at WordPress security platform Patchstack in early October 2026, puts more than 530,000 WordPress installations at direct risk. The two unrelated plugins were hit by what appears to be a single threat actor using the same payload infrastructure, making the Ninja Forms WPC Product Bundles attacks one of the most instructive plugin-compromise campaigns of the month.

What Happened: Ninja Forms WPC Product Bundles Exploitation

The two flaws are tracked as CVE-2026-94504, affecting Ninja Forms versions 3.15.3 and older, and CVE-2026-93836, affecting WPC Product Bundles for WooCommerce versions 8.6.6 and older. Both are stored cross-site scripting vulnerabilities (CWE-79) rated high severity with CVSS base scores of 7.1 to 7.2. Patchstack’s telemetry first caught active exploitation of the WPC Product Bundles flaw on October 4, 2026; attacks against Ninja Forms users followed the very next day.

The attack chain is elegant and dangerous. The attacker first plants malicious JavaScript by submitting it through a Ninja Forms form or by storing it in WooCommerce order data. Nothing happens until a logged-in WordPress administrator views the poisoned content — at that moment, the payload executes inside the victim’s authenticated wp-admin session. The script harvests WordPress security nonces and then abuses legitimate administrative functions to install a rogue plugin, create new administrator accounts, establish long-term persistence, and deploy additional access mechanisms.

Both attack waves pulled their JavaScript payload from the same domain, imgcdn1[.]com (delivered as x.js), which strongly suggests a single threat actor behind the Ninja Forms WPC Product Bundles campaign. The post-exploitation implant is a purpose-built WordPress persistence kit: it installs a malicious plugin disguised under the slug wp-smart-thumbnails with the benign-sounding name “WP Smart Thumbnails,” complete with a packed file manager, an emergency runner, and two must-use plugin paths. It creates administrator accounts that are hidden from the standard Users screen, so a dashboard review shows nothing wrong. It exposes an unauthenticated file manager through a direct request to the plugin’s main PHP file, and it installs a token-based magic login URL (of the form /?_wplogin=) that authenticates whoever holds it as the site’s oldest administrator. The implant even backdates its files to match the oldest WordPress-root timestamp, which makes filesystem modification-time review unreliable. Patchstack’s warning is blunt: “two is what we have confirmed, not what we expect the final count to be.” Security teams tracking the Ninja Forms WPC Product Bundles campaign should also watch for the same payload domain appearing against other plugins.

Who Is Affected by the Ninja Forms WPC Product Bundles Campaign

Ninja Forms is installed on more than 500,000 WordPress websites and is commonly used to build custom forms without coding. WPC Product Bundles for WooCommerce has more than 30,000 active installations and lets store owners group products into bundled offers. Together, the Ninja Forms WPC Product Bundles flaws expose over half a million sites.

Any site running Ninja Forms 3.15.3 or older, or WPC Product Bundles 8.6.6 or older, is vulnerable. The fixed versions are Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7. The trigger condition matters: the payload executes when an authenticated administrator views the poisoned submission or order data, so sites where admins routinely review form entries or WooCommerce orders are the most likely to have been compromised. If either of the Ninja Forms WPC Product Bundles plugins is installed but unused, deactivate and delete it — unused plugins are still exploitable.

Why the Ninja Forms WPC Product Bundles Attack Matters

This campaign matters because patching does not undo the damage. Updating to the fixed versions stops further exploitation, but it does not remove an existing infection — the backdoor plugin, hidden administrators, and must-use persistence mechanisms all survive a routine update. Worse, the implant is engineered to evade the checks site owners normally rely on: hidden admins do not appear in the dashboard, and backdated file timestamps defeat “recently modified files” reviews. The Ninja Forms WPC Product Bundles incident shows why stored XSS deserves its high severity rating in practice. A site can look clean in wp-admin while an attacker holds a magic login URL.

The campaign also signals a shift in attacker tradecraft. Rather than exploiting each plugin differently, one actor weaponized the same stored-XSS-to-admin-session technique against two unrelated plugins in back-to-back waves. Any widely installed plugin that stores user input an administrator later views is a potential carrier for the same playbook.

What to Do Now After the Ninja Forms WPC Product Bundles Attacks

Update both plugins immediately. Install Ninja Forms 3.15.4 or newer and WPC Product Bundles 8.6.7 or newer. This stops new exploitation.
Assume you may already be compromised if you ran a vulnerable version while admins were active. Updating alone is not cleanup.
Hunt for hidden administrators by querying the database directly. Do not trust the Users screen — the implant hides its accounts from the dashboard. Check the users and usermeta tables for unexpected administrator-capable accounts.
Inspect the must-use plugins directory (wp-content/mu-plugins) for files you did not put there, and look for a plugin with the slug wp-smart-thumbnails.
Review web server logs for requests to imgcdn1.com, for /?_wplogin= token URLs, and for direct requests to plugin PHP files that bypass WordPress routing.
Rotate credentials. Change all administrator passwords, reset WordPress salts, and force-logout all sessions.
Restore from a known-clean backup if compromise is confirmed, then re-apply the patched plugin versions on the clean copy.
Get professional help for a Ninja Forms WPC Product Bundles cleanup. If the steps above feel out of reach, professional web design and security support can audit and disinfect the site properly.

Ninja Forms WPC Product Bundles: Frequently Asked Questions

If I update to the fixed versions, am I safe?
Not automatically. The update blocks new attacks through these flaws, but any backdoor installed before the update remains. You must also hunt for hidden admins, rogue plugins, and must-use implants.

How do I find an administrator hidden from the dashboard?
Query the database directly — the Users screen cannot be trusted here, because the Ninja Forms WPC Product Bundles implant specifically hides its accounts from the dashboard. Look in wp_users and wp_usermeta for accounts with administrator capabilities that you do not recognize, and check for recently created accounts.

Which versions are safe?
Ninja Forms 3.15.4 and newer, and WPC Product Bundles for WooCommerce 8.6.7 and newer. Anything older needs the update plus a compromise check.

Could more plugins be hit by the same actor?
Possibly. Patchstack explicitly warns that the two confirmed plugins may not be the final count, since the same payload infrastructure can be pointed at any stored-XSS flaw the actor finds next.

Ninja Forms WPC Product Bundles: Conclusion

The Ninja Forms WPC Product Bundles campaign is a textbook example of why stored XSS in popular plugins is a critical-severity problem in practice, not just on paper. A single threat actor turned two unrelated flaws into full site takeovers across more than half a million installations — installing a disguised backdoor plugin, hiding administrator accounts from the dashboard, and laying persistence that survives updates and defeats timestamp reviews. The fixes are simple (Ninja Forms 3.15.4, WPC Product Bundles 8.6.7), but the cleanup is not: patching stops the bleeding while a real compromise hunt — database-level admin audits, mu-plugin inspection, and log review — closes the wound.

If your site runs either plugin, do the update and the compromise check this week. For agencies, the Ninja Forms WPC Product Bundles campaign is also a reminder to keep client plugin inventories current, so the next emergency patch list takes minutes instead of days. Qamar Digital Ventures LLC‘s website care plans include proactive updates, security monitoring, and expert cleanup when incidents like this strike. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to get your site audited.

Sources

Free website & SEO audit

Want results like these?

Get a plain-English teardown of your website and Google visibility — what is broken, what to fix first, and what it would take to outrank your competitors in Albuquerque.

Get My Free Audit

No pressure, no 40-page PDF. Real answers.

Keep reading