Hidden admin attack hits Ninja Forms and WPC Product Bundles

On 6 October 2026 Patchstack described a campaign that creates a hidden administrator on WordPress sites. It uses two stored XSS vulnerabilities that need no account. One is in Ninja Forms up to version 3.15.3 (CVE-2026-94504), the other in WPC Product Bundles for WooCommerce up to version 8.6.6 (CVE-2026-93836). The fixes are in Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7, and the first attacks were recorded on 4 October.

How the hidden admin attack works

The attacker saves a malicious script in data that an administrator opens as part of the job, for example a WooCommerce order or a submitted Ninja Forms form. The script runs in the administrator's browser the moment they look at the data. According to Patchstack, the script does not steal the login cookie but uses the session that is already open.

With that session the script uploads a plugin named wp-smart-thumbnails through WordPress's own installer and creates a visible administrator. Then it creates a second administrator that does not show in Users > All Users, in the role filter or in the counters above the list. A must-use plugin (mu-plugin) in the wp-content/mu-plugins folder hides it.

These are two of the four ways back in that Patchstack describes. The other two are a login address that signs in as the oldest administrator, and a file manager in the uploaded plugin with no access check at all. That is why removing the script is not enough. According to Patchstack, removing the vulnerable or the uploaded plugin does not close the hidden administrator, the login address or the file manager either.

Both vulnerabilities have been public since 22 September. Patchstack saw the first attempt on 4 October against WPC Product Bundles, and the next day the same code through Ninja Forms. The volume of attacks in Patchstack's data is still limited. Patchstack says that two vulnerabilities are the ones confirmed so far and does not expect this to be the final number. The CVSS score is 7.1 according to Patchstack and 7.2 in the NVD records submitted by Wordfence.

Are you affected?

You are affected if you use Ninja Forms up to and including 3.15.3 or WPC Product Bundles up to and including 8.6.6. According to their wordpress.org pages, Ninja Forms has over 500,000 active installations and WPC Product Bundles over 30,000. The versions are in Plugins > Installed Plugins, and in cPanel's Terminal one command shows them. How to work with WP-CLI is described in the WP-CLI guide.

# cPanel > Terminal, in the site's folder
# Read-only. Shows the versions of both plugins.
wp plugin list --fields=name,status,version \
  | grep -E "ninja-forms|woo-product-bundle"

The update closes the hole, but it does not remove what has already been planted. So check for the signs of the campaign too. They are:

• the folder wp-content/plugins/wp-smart-thumbnails, which Patchstack describes as "WP Smart Thumbnails" 1.2.4 by "MediaPress Labs";
• files you do not know in wp-content/mu-plugins, above all class-wp-token-validate.php and a file whose name starts with class-wp-query-;
• an administrator that is in the database but not on the Users > All Users screen;
• the options fz_emer_done_v1 and fz_emer_login_tokens in the options table.

The commands below only read. If your table prefix is not wp_, replace it with yours. The same queries work in phpMyAdmin in cPanel.

# cPanel > Terminal, in the site's folder
# Read-only. Looks for the traces of the campaign.
ls -d wp-content/plugins/wp-smart-thumbnails
ls -la wp-content/mu-plugins
wp db query 'SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON m.user_id = u.ID
WHERE m.meta_key = "wp_capabilities"
AND m.meta_value LIKE "%administrator%"'
wp db query 'SELECT option_name FROM wp_options
WHERE option_name IN ("fz_emer_done_v1", "fz_emer_login_tokens")'

Compare the administrators from the database with the Users > All Users screen. Patchstack writes that the name of the hidden account is a plain word such as support, updater, maintenance or backup, and its email is on @wordpress.org. An administrator from the database that is missing from the screen is a reason to act at once.

What to do

1. Update Ninja Forms to 3.15.4 or newer and WPC Product Bundles to 8.6.7 or newer. Ninja Forms 3.15.5 of 28 September adds more protection against XSS. If you cannot update right away, switch the plugin off until you can, and do not open orders and forms you do not recognise in the admin.
2. Do the check above, even if you updated long ago.
3. If you find a sign, treat the site as compromised. First save a copy of the site, as in the backup guide. Then remove the unknown administrators, the wp-smart-thumbnails plugin, the files in mu-plugins and the two options, and change the passwords and the secret values (salts) in wp-config.php. Change the password of the oldest administrator too, because the login address signs in as that account even though its password was not stolen.
4. Write to your host's support if you are not sure what you are seeing.

What we do

If you find traces of the campaign, with hacked site cleanup we remove the hidden administrator, the backdoors and the malware and close the hole, wherever the site is hosted. You can describe what you found in the inquiry form. If there are no traces, vulnerability (CVE) monitoring tells you what to update before the next campaign exploits it.

Sources

• Patchstack, the XSS campaign that hides its own admin account
• NVD, CVE-2026-93836
• NVD, CVE-2026-94504
• WordPress.org, Ninja Forms
• WordPress.org, WPC Product Bundles for WooCommerce