Loading story…
Attackers are exploiting high-severity stored cross-site scripting flaws in two WordPress plugins to install backdoors and create rogue administrator accounts. The vulnerabilities affect Ninja Forms 3.15.3 and earlier (CVE-2026-94504) and WPC Product Bundles for WooCommerce 8.6.6 and earlier (CVE-2026-93836). Exploitation requires an authenticated session: attackers embed malicious JavaScript in form submissions or WooCommerce order data, which executes with a logged-in administrator’s privileges when the administrator views the content. Patchstack observed attacks on October 4 and 5; a shared JavaScript payload suggests the same threat actor, although observed exploitation remains limited in scale.
The payload abuses the administrator’s session to install a malicious plugin and establish persistent access through hidden administrator accounts, a secret login URL, and auxiliary plugins with backdated file timestamps. Administrators should update Ninja Forms to 3.15.4 or later and WPC Product Bundles to 8.6.7 or later, then separately investigate unauthorized administrator accounts, suspicious plugins, and other persistence mechanisms. Updating the vulnerable plugins closes the flaws but does not remove backdoors or remediate existing compromises.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
On October 5, Patchstack observed attacks exploiting CVE-2026-94504 in Ninja Forms versions 3.15.3 and earlier through malicious form submissions. Both plugin attacks delivered the same JavaScript payload from imgcdn1[.]com, suggesting a shared threat actor.
On October 4, Patchstack identified attacks exploiting CVE-2026-93836, a stored cross-site scripting flaw affecting WPC Product Bundles for WooCommerce versions 8.6.6 and earlier. Attackers planted malicious JavaScript in order data to execute within an administrator's authenticated session.
Patchstack detailed how the payload installs a malicious plugin masquerading as WP Smart Thumbnails and establishes visible and hidden administrator accounts, a secret login URL, and an unauthenticated file manager, with auxiliary plugins maintaining persistence. It advised updating both vulnerable plugins and separately investigating compromise because updates do not remove existing infections.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical stored cross-site scripting flaw, tracked as **`CVE-2026-65048`**, was disclosed in the **Ninja Forms** WordPress plugin. The vulnerability affects versions **`3.10.4` through `3.14.9`** and stems from the plugin's **Repeatable Fieldset** feature, where submission indexes are accepted without numeric validation and later rendered into HTML without proper escaping. Because the vulnerable input can be submitted through a public form, the issue can be exploited by an unauthenticated attacker. A successful attack stores malicious JavaScript in form submissions and triggers execution when an administrator reviews those submissions in the WordPress admin panel. The flaw carries a **CVSS 3.1 score of 9.3** and could enable session-cookie theft, administrator account creation, malicious plugin installation, and unauthorized modification of site content. Site owners using Ninja Forms are advised to upgrade to **`3.15.0`** or later to remediate the issue.
Sep 4, 2026
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Jun 29, 2026
A critical vulnerability in the WordPress plugin **Ninja Forms – File Uploads** has exposed more than **50,000 sites** to unauthenticated arbitrary file upload, with security researchers and CSIRT.SK reporting active exploitation in the wild. Tracked as `CVE-2026-0740`, the flaw affects versions **3.3.26 and earlier** and stems from insufficient validation of uploaded file types, file extensions, and file paths in `NF_FU_AJAX_Controllers_Uploads::handle_upload`, allowing attackers to upload malicious files, including PHP scripts. Successful exploitation can lead to **remote code execution** and full site compromise, giving attackers a path to persistent access and broader server takeover. Defenders are urged to update immediately to **version 3.3.27 or later** and review affected WordPress installations for unauthorized uploads or filesystem changes, as public reporting indicates the vulnerable plugin was deployed on tens of thousands of websites at the time of disclosure.
Jul 24, 2026