Affected Systems

Ninja Forms plugin versions 3.15.3 and older (500,000+ sites); WPC Product Bundles for WooCommerce versions 8.6.6 and older (30,000+ sites). Tracked as CVE-2026-93836 and CVE-2026-94504. Both are authenticated stored XSS vulnerabilities.

Exploitation Status

Active exploitation confirmed since October 4, 2026. Threat actor delivering JavaScript payload from imgcdn1[.]com to install backdoors, create hidden admin accounts, and deploy malicious "WP Smart Thumbnails" plugin.

Business Impact

Attackers gain persistent administrative access via four mechanisms: visible admin account, hidden admin account (invisible in WordPress dashboard), secret login URL, and unauthenticated file manager. Persistence survives plugin removal. Exploitation requires authenticated session (contributor-level or higher). Currently limited in scope but enables full site compromise.

Urgency

🔴 Immediate

Recommended Actions

  • Update Ninja Forms to version 3.15.4 or later and WPC Product Bundles for WooCommerce to version 8.6.7 or later immediately
  • Audit all administrator accounts in WordPress database directly (wp_users table) for hidden accounts not visible in dashboard
  • Search for installed plugin 'WP Smart Thumbnails' version 1.2.4 from MediaPress Labs and remove if present
  • Review WooCommerce order data and Ninja Forms submissions for injected JavaScript payloads (x.js from imgcdn1[.]com)
  • Check web server access logs for requests to plugin PHP files and unusual authentication patterns, especially secret login URLs