Stored XSS in Ninja Forms & WPC Bundles Enables Silent WP Admin Backdoors

What’s happening

A malicious script hosted on imgcdn1.com is being delivered through WooCommerce order data or Ninja Forms submissions. When a logged‑in administrator views the injected content, the script runs, steals WordPress nonces and silently installs a rogue plugin called “WP Smart Thumbnails”.

Technical specifics

Vulnerabilities

Both plugins suffer from stored cross‑site scripting that requires an authenticated session to exploit. The flaws are tracked as CVE‑2026‑93836 (WPC Product Bundles for WooCommerce ≤ 8.6.6) and CVE‑2026‑94504 (Ninja Forms ≤ 3.15.3). Patchstack first saw the abuse on 2026‑10‑04 (WPC) and 2026‑10‑05 (Ninja Forms).

Payload and persistence

• The JavaScript pulls administrative nonces and calls legitimate WordPress functions to drop the malicious plugin.
• The fake plugin registers four persistence mechanisms:
  1. A visible administrator account.
  2. A concealed admin account hidden from the dashboard.
  3. A secret login URL that authenticates as the site’s oldest admin.
  4. An unauthenticated file‑manager endpoint reachable via the plugin’s main PHP file.

The file manager can’t run commands but can be used to upload additional payloads. Even if the “WP Smart Thumbnails” plugin is removed, the hidden account and secret URL survive because auxiliary attack plugins with back‑dated timestamps keep them alive.

Who’s at risk

Ninja Forms powers more than 500,000 WordPress sites, while WPC Product Bundles for WooCommerce is active on over 30,000 sites. Any site that runs an affected version and has an administrator who views a compromised form or order is vulnerable.

Defensive steps

• Upgrade immediately to WPC Product Bundles for WooCommerce 8.6.7 or later and Ninja Forms 3.15.4 or later.
• Audit admin accounts: look for unexpected users, especially ones without a dashboard entry.
• Check for the presence of a “WP Smart Thumbnails” plugin folder or the secret login URL pattern (/wp-content/plugins/wp-smart-thumbnails/).
• Remove any unknown plugins and run a file‑integrity scan against a clean WordPress core.
• Rotate all WordPress nonces and force password resets for existing admin accounts.

Bottom line

Updating the plugins stops new infections, but the backdoor can linger. Administrators must hunt for the hidden accounts and rogue plugin files before assuming the site is clean.