Ninja Forms WooCommerce Backdoor: What to Check Right Now

Patchstack confirmed an active exploit campaign against Ninja Forms and WPC Product Bundles starting October 4, 2026, planting backdoors on unpatched WooCommerce stores via stored XSS flaws. The attack installs hidden administrator accounts and full-server file managers. Both plugins have patches, but applying one now does nothing for a backdoor that is already installed.

How the Ninja Forms WooCommerce backdoor works

Both vulnerabilities are stored cross-site scripting (XSS) flaws. An attacker with an authenticated session submits a malicious payload through a Ninja Forms form or through WooCommerce order data. The payload sits in the database until a site administrator opens the affected submission or order record, then fires as JavaScript with admin-level privileges inside that browser session.

The script fetches a second-stage payload from the attacker-controlled domain imgcdn1[.]com and installs a fake plugin named “WP Smart Thumbnails.” That plugin then:

• Creates one visible and one hidden administrator account
• Registers a secret login URL tied to the oldest existing admin account
• Deploys an unauthenticated file manager with read, upload, and delete access across the server
• Buries the hidden admin inside a Must-Use plugin file designed to exclude it from standard WordPress user queries

Patchstack confirmed that both attacks used the same JavaScript payload from imgcdn1[.]com, pointing to a single threat actor exploiting both flaws at once.

The affected versions and their fixes:

• Ninja Forms (CVE-2026-94504): versions 3.15.3 and earlier are vulnerable. Version 3.15.4, released September 21, 2026, is the fix. The changelog credits Venkateswara Reddy Challa for the responsible disclosure.
• WPC Product Bundles for WooCommerce (CVE-2026-93836): versions 8.6.6 and earlier are vulnerable. Version 8.6.7 is the fix, with the vulnerability reported by lhking from Wordfence.

Both CVEs carry a CVSS score of 7.1 (high severity). As of the Patchstack disclosure, neither appeared in CISA’s Known Exploited Vulnerabilities catalog, but both were being actively targeted.

What this means for your WooCommerce store

Ninja Forms is installed on more than 500,000 WordPress sites; WPC Product Bundles for WooCommerce is active on more than 30,000. Any store that ran either plugin in a vulnerable version and received form submissions or customer orders between October 4 and its patch date must run a backdoor check.

For WooCommerce stores, the WPC Product Bundles injection point is customer order data. Any shop that accepted orders while running version 8.6.6 or older, and where an admin later reviewed those orders, may have already triggered the payload. Scrolling through October orders in the WooCommerce admin is enough to execute the script.

The Ninja Forms patch landed September 21; the first confirmed attacks on Ninja Forms sites appeared October 5, a 14-day window between fix and active exploitation. Stores that auto-update plugins and were already on 3.15.4 before October 5 are clean. Stores that update manually and were still on 3.15.3 on that date need to go further than installing the patch.

With a hidden admin account and full-server file manager access, an attacker can read customer records, modify checkout pages to capture card data, redirect payments, or pull files from anywhere on the server.

If you are still working through the WordPress 7.1.3 security release from last week, add these plugin updates to the same queue.

What to do right now

1. Update both plugins immediately. Go to Plugins → Updates and bring Ninja Forms to 3.15.4 or later and WPC Product Bundles to 8.6.7 or later. If neither plugin is installed on your site, skip to step 7.
2. Scan for the fake payload plugin. Open Plugins → All Plugins and look for anything called “WP Smart Thumbnails” or any plugin you do not recognise. Deactivate and delete it.
3. Check wp-content/mu-plugins/ over FTP or SSH. Must-Use plugins run automatically and bypass normal plugin management. Delete any file in that directory you did not put there.
4. Audit your administrator accounts. Go to Users → All Users, filter by the Administrator role, and look for accounts you do not recognise, including ones with backdated or unusual registration dates.
5. Query the database directly. Run SELECT * FROM wp_usermeta WHERE meta_key = 'wp_capabilities' AND meta_value LIKE '%administrator%' and match the results against users you know. The hidden admin account is designed to disappear from the standard WordPress admin UI.
6. Regenerate WordPress authentication salts. Update the Security Keys section in wp-config.php, or use a security plugin’s “reset salts” function. This invalidates all active sessions, including any the attacker may be holding.
7. Search server access logs for imgcdn1[.]com. A hit confirms that a payload was delivered to your server. Check Apache/Nginx access logs and any CDN logs.
8. Reset all admin passwords after completing the steps above, not before. Changing passwords does not kill active sessions unless the salts have already been regenerated.

If you find evidence of compromise (an unknown admin account, files in mu-plugins you did not install, or log requests to imgcdn1[.]com), do not treat the cleanup as a simple file deletion. Multiple persistence mechanisms are common in this class of attack. Restore from a verified clean backup taken before October 4, or bring in a security specialist for forensic cleanup.

Who is not affected

Stores that do not use Ninja Forms or WPC Product Bundles are not exposed to these specific CVEs. Stores running Ninja Forms 3.15.4 or later before October 5, and WPC Product Bundles 8.6.7 or later before October 4, are safe from this campaign.

Restricting guest checkout does not eliminate the risk: the attack requires an authenticated session, and a registered customer account is enough. Stores with customer accounts enabled and order review workflows should still work through the checklist above.

Sources

• PrivacySavvy: Hackers Exploit Ninja Forms and WooCommerce Plugin Flaws to Plant Hidden Admin Backdoors
• ReconBee: Ninja Forms plugin flaw exploited to hack WordPress sites
• Mallory AI: Ninja Forms and WPC Product Bundles XSS Flaws Exploited to Backdoor WordPress Sites
• WordPress.org: Ninja Forms plugin changelog
• WordPress.org: WPC Product Bundles for WooCommerce changelog