Most website admins treat the form submissions inbox like a junk drawer: open it, skim it, close it. This week, attackers found a way to make that one bored click the most expensive thing you'll do all month. It turns out the scariest thing on a WordPress site isn't the login page. It's the "View Submissions" screen.

Two Plugins, One Very Patient Payload

Attackers are actively exploiting stored cross-site scripting (XSS) flaws in two WordPress plugins: Ninja Forms (CVE-2026-94504, versions 3.15.3 and older, 500,000+ active installs) and WPC Product Bundles for WooCommerce (CVE-2026-93836, versions 8.6.6 and older, 30,000+ installs). Both bugs carry a CVSS score of 7.2. The trick is to plant malicious JavaScript in a form entry or WooCommerce order and wait. When a logged-in administrator opens it, the script runs inside the admin's own session and uses their legitimate security tokens.

WordPress security firm Patchstack spotted the campaign. The flaws were disclosed September 22, the attack domain (imgcdn1.com) was registered October 1, exploitation of WPC Product Bundles started October 4, and the same payload hit Ninja Forms the next day. Most of the attack traffic came through Tor exit nodes, because of course it did.

Four Ways In, Zero Ways You'd Notice

This isn't a smash-and-grab. According to Patchstack's findings, the payload sets up four separate ways back in: a fake plugin called "WP Smart Thumbnails" hiding a file manager, an administrator account hidden from the Users dashboard, must-use plugins that cover for a second rogue admin, and a "magic login" link for passwordless access. The files are even backdated so they look older than the WordPress install itself. That's less like hacking and more like forging the deed to your house.

Here's what most people miss: updating the plugins closes the door, but it doesn't evict anyone already living in the attic. The recommended cleanup is to update to Ninja Forms 3.15.4+ and WPC Product Bundles 8.6.7+, search your logs for imgcdn1.com, query the database directly for admins that don't show up in the dashboard, check the mu-plugins folder by what's actually in the files rather than their dates, then remove the rogue accounts and reset your WordPress security keys. If your security plan is "we'll patch it Tuesday," the attackers are betting you'll skip steps two through five.

Moral of the story: in 2026, even your contact form needs a background check.

If you're not sure whether someone moved into your CMS while you weren't looking, the WTK team can run a proper audit that goes past "did we click Update?" and actually digs for hidden admins.

Source: SecurityOnline