Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are actively exploiting stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins to install backdoors and create rogue administrator accounts. The vulnerabilities, CVE-2026-93836 and CVE-2026-94504, require authenticated access and have been exploited since October 4, 2026. A malicious JavaScript payload delivered from imgcdn1[.]com executes in the context of logged-in administrators, deploying a malicious plugin named 'WP Smart Thumbnails' and establishing multiple persistence mechanisms, including hidden admin accounts and secret login URLs. The same threat actor is linked to both campaigns due to identical payloads.

AI-extracted · verify before operational use