If your WordPress site runs Ninja Forms, check your installed version right now. WordPress security firm Patchstack detected active exploitation of a stored cross-site scripting flaw in Ninja Forms starting October 5, 2026 — and the attack doesn’t just deface your site. It plants hidden administrator accounts and backdoors that survive even after you delete the vulnerable plugin.
The flaw is tracked as CVE-2026-94504 and affects Ninja Forms versions 3.15.3 and older. It carries a CVSS score of 7.2 (High). The fix is in version 3.15.4, which tightened output escaping in the admin submission screen.
But here’s the part site owners keep getting wrong: updating the plugin does NOT clean up a site that’s already compromised. The payload was designed for persistence, not testing.
What happened: the timeline
- October 4, 2026 — Patchstack’s telemetry first caught the malicious payload, delivered through a separate flaw (CVE-2026-93836) in WPC Product Bundles for WooCommerce (30,000+ active installs). WPC Product Bundles versions 8.6.6 and older are affected.
- October 5, 2026 — the identical JavaScript payload appeared in attacks against Ninja Forms (500,000+ active installs).
- October 6, 2026 — Patchstack published its full analysis of the campaign.
The shared second-stage payload — served from the same domain, imgcdn1.com — ties both attack waves to one threat actor. Patchstack warned that “two is what we have confirmed, not what we expect the final count to be,” because the post-exploitation stage is plugin-agnostic: any stored XSS that puts JavaScript in front of a WordPress admin is a candidate vector for the same implant.
This was a brutal month for form plugins overall. On October 8, a separate critical flaw (CVE-2026-17609, CVSS 9.1) surfaced in Super Forms. If October 2026 teaches site owners anything, it’s that the form on your contact page is now prime attack surface.
How the attack works (no login needed)
Both flaws are unauthenticated stored XSS vulnerabilities. Here’s the mechanics, per Patchstack’s analysis:
- The attacker submits crafted content through the plugin’s normal form submission endpoint — the same public form your visitors see. No account, no login.
- That content sits quietly until a logged-in WordPress administrator views the submission in the admin editor.
- The stored JavaScript then executes inside the administrator’s live session — riding their authenticated session rather than stealing cookies.
- The script grabs the necessary security nonces from admin pages and uses legitimate WordPress functions to do the attacker’s work.
That’s the ugly elegance of it: it doesn’t break into the admin panel, it waits for the admin to come to it.
Four backdoors — not one
The payload installs persistence through four separate access mechanisms, which is why simply updating the plugin doesn’t evict an intruder:
- A visible administrator account — the one you might notice and delete.
- An administrator account hidden from the WordPress Users screen — the one you won’t notice by checking Users.
- A secret login URL that silently authenticates the holder as the site’s oldest administrator.
- A file manager that requires no authentication, bundled inside a malicious plugin posing as “WP Smart Thumbnails” version 1.2.4, supposedly from “MediaPress Labs.”
That fake thumbnail plugin is the one to look for: its files were deliberately timestamped to appear older than the WordPress installation so they’d blend in with legitimate uploads. Delete the plugin and the visible rogue account, and the hidden admin, secret URL, and file manager can still give the attacker full control.
What to do right now
Don’t panic — work through this checklist in order.
Step 1: Update immediately
Update Ninja Forms to 3.15.4 or later and WPC Product Bundles for WooCommerce to the patched version. If you use either plugin and can’t update within the hour, that’s the time to escalate — this isn’t a “next maintenance window” situation when exploitation is active.
Step 2: Assume breach until proven otherwise
Patchstack’s analysis is explicit: removing the vulnerable plugin or the malicious one does not close most of the backdoors this campaign leaves behind. So before you relax:
- Check Plugins for “WP Smart Thumbnails.” It isn’t a real plugin from a real company. If it’s there, your site was compromised — and deleting it is step one of cleanup, not the whole cleanup.
- List administrator accounts directly in the database (via phpMyAdmin or WP-CLI:
wp user list --role=administrator), not just the Users screen — the campaign creates an admin hidden from the dashboard. Compare against every person who should actually have access. - Look for suspicious login files or secret endpoints. Check your
uploadsand plugin directories for files with timestamps that don’t match your install history, and for any plugin you don’t remember installing. - Check WooCommerce order data and form submissions for content containing
<script>tags pointing atimgcdn1.com— that’s the campaign’s delivery infrastructure.
Step 3: If you find anything, treat it as a full compromise
That means: restore from a known-clean backup made before October 4, 2026, rotate every credential (admin passwords, hosting panel, FTP/SFTP, database password, API keys), and re-scan the restored site. If you don’t have a clean backup, hire this out — a proper WordPress malware cleanup service earns its fee on days like this. The supply-chain attack write-up on this site covers why plugin-based compromises are getting harder to spot manually.
Step 4: Lock down going forward
- Turn on automatic updates for plugins (Dashboard → Updates → enable auto-updates) — or better, a managed update policy through a maintenance service.
- Put the site behind a web application firewall. Cloudflare’s free tier in front of WordPress is covered in this guide — it won’t stop stored XSS, but it blocks a lot of the scanning and probing that precedes campaigns like this.
- Give admins the least privilege they need. If someone only edits blog posts, they don’t need an administrator account — an editor role means their session can’t be used to install plugins even if a payload executes in it.
Why this campaign is a trend, not a one-off
Two things make this bigger than one plugin:
First, the target selection. Contact-form plugins and WooCommerce add-ons sit on hundreds of thousands of small-business sites — and their admins routinely open submissions from strangers. The attack path runs through the most routine admin workflow there is. That’s not an accident; it’s threat actors doing market research on admin behavior.
Second, the economics. The campaign’s volume was limited in Patchstack’s telemetry. This wasn’t a worm blasting every WordPress site — it was a targeted operation building quiet, persistent access. Sites compromised this way can be monetized later: spam SEO injections, phishing pages on trusted domains, or access sold to other actors. If you were hit and didn’t notice, the bill comes due on someone else’s timeline.
For anyone running a business on WordPress — store, blog, agency site, membership platform — this is the practical lesson: your plugin list is your attack surface, and “nobody would target my small site” stopped being true years ago. Update today, verify tomorrow, and treat every form plugin like the front door it is.
Frequently Asked Questions
Which Ninja Forms versions are vulnerable to CVE-2026-94504?
Versions 3.15.3 and older. Version 3.15.4 fixed it by strengthening output escaping in the admin submission screen.
How do I know if my site was hacked?
Look for a plugin called “WP Smart Thumbnails” (fake — not from a real company), administrator accounts you don’t recognize (check via the database, not just the Users screen, since the campaign hides one), and form submissions containing scripts from imgcdn1.com.
Does updating Ninja Forms remove the hack?
No. The update closes the hole that let attackers in, but the backdoors — hidden admin account, secret login URL, unauthenticated file manager — survive the update. Compromised sites need a full cleanup: clean backup, credential rotation, and a malware scan.
What’s WPC Product Bundles for WooCommerce, and is it affected?
It’s a WooCommerce add-on for selling grouped products as bundles, with 30,000+ installs. Versions 8.6.6 and older carry CVE-2026-93836, hit by the same campaign on October 4, 2026.
Was there really a separate WordPress form plugin hack the same week?
Yes — on October 8, 2026, a critical flaw (CVE-2026-17609, CVSS 9.1) was disclosed in the Super Forms plugin. It was a separate vulnerability, but it made October an especially bad month for form plugins.
Do I need to change my passwords?
If there’s any sign of compromise — yes, everything: WordPress admins, hosting control panel, SFTP, database, and any API keys stored on the site. If you patched before any admin opened a malicious submission, you’re likely fine, but rotating admin passwords is cheap insurance.
Sources: Four ways back in: the WordPress XSS campaign that hides its own admin account; Ninja Forms plugin flaw exploited to hack WordPress sites; Related: WordPress supply-chain attacks in 2026; Related: Cloudflare free CDN for WordPress.