Security Vulnerabilities in Popular WordPress Plugins Targeted by Hackers
Recent reports indicate that cybercriminals are capitalizing on stored cross-site scripting (XSS) vulnerabilities found in two distinct WordPress plugins: Ninja Forms and WPC Product Bundles for WooCommerce.
Their objective is to infiltrate these systems to insert backdoors and establish unauthorized administrative accounts.
These vulnerabilities have been assigned a high severity rating, necessitating an authenticated user session for exploitation.
They are cataloged as CVE-2026-93836, impacting WPC Product Bundles for WooCommerce versions 8.6.6 and earlier, and CVE-2026-94504, affecting Ninja Forms versions 3.15.3 and older.
The Ninja Forms plugin, a popular tool designed to facilitate custom form creation without coding, boasts installations on over 500,000 websites.
Meanwhile, WPC Product Bundles for WooCommerce enables the bundling of grouped products and is currently utilized on more than 30,000 WordPress sites.
This security threat came to light on October 4, when Patchstack, a prominent WordPress security entity, detected malicious activity targeting users of WPC Product Bundles for WooCommerce. The next day, similar attacks were observed against the Ninja Forms plugin.
In both instances, an identical JavaScript payload was deployed from the domain ‘imgcdn1[.]com’, suggesting the presence of a singular adversarial force orchestrating the attempts on both plugins.
According to the research findings, the perpetrator endeavors to embed a harmful JavaScript file (known as x.js) within either WooCommerce order details or Ninja Forms submissions.
The execution of this script occurs when a logged-in administrator accesses the compromised content, utilizing the active WordPress session.
Upon activation, the script retrieves essential administrative nonces and employs legitimate WordPress functions to deploy a malicious plugin that masquerades as “WP Smart Thumbnails” version 1.2.4 from “MediaPress Labs,” subsequently creating an administrator account.
At this juncture, both the JavaScript payload and the compromised plugin’s PHP scripts establish four distinct access pathways to the infiltrated site:
- A visible administrator account.
- An administrator account that remains hidden from the WordPress user list in the dashboard.
- A clandestine login URL that authenticates using the site’s oldest existing administrator credentials.
- An unauthenticated file manager accessible through a straight request to the main PHP file of the malicious plugin
While the file manager lacks the capability to execute commands, it remains susceptible to introducing additional harmful payloads onto the site.
Even after the removal of the WP Smart Thumbnails plugin from the compromised site, the hidden administrator account and secret login URL persist as mechanisms for maintaining access.
This is facilitated through auxiliary attack plugins with backdated timestamps that are designed to evade detection.
“The [hidden] account does not appear in Users → All Users, does not appear in the Administrator filter, and is not counted in the totals above the list,” Patchstack elucidates, further commenting, “It is a fully privileged administrator the site owner cannot see.”
While the exploitation is currently deemed to be limited, Patchstack advises website administrators to upgrade to the most recent versions of the affected plugins: WPC Product Bundles for WooCommerce version 8.6.7 or newer and Ninja Forms 3.15.4 or newer.
Updating these vulnerable plugins mitigates the risk of further exploitation; however, it does not rectify an existing infection. Administrators are strongly urged to scrutinize their sites for any signs of compromise.
Source link: Bleepingcomputer.com.
