Exploitation of Two WordPress Plugin Vulnerabilities to Gain Unauthorized Access

Attackers are exploiting two high-severity vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce plugins to target WordPress websites, installing backdoors and creating hidden administrator-level user accounts. Severity of the vulnerabilities: High. [...] The post Exploitation of Two WordPress Plugin Vulnerabilities to Gain Unauthorized Access first appeared on Safir Arjan.

By exploiting two high-severity vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce plugins, attackers target WordPress websites and attempt to install a backdoor and create secret user accounts with administrator access level.

According to ICT News, vulnerability severity: high

According to the report of the Strategic Management Center of Afta, according to the report of the Patchstack security company, these vulnerabilities are of the type of stored cross-site scripting (Stored XSS) and have been identified with the identifiers CVE-2026-94504 in the Ninja Forms plugin and CVE-2026-93836 in the WPC Product Bundles for WooCommerce plugin. Exploiting these flaws requires authentication.

By injecting malicious JavaScript code into form information or store order data, attackers execute the code when the administrator views the infected content. This process allows installing malicious plugins, creating hidden admin accounts and maintaining unauthorized access to the website. Even removing the malicious plugin may not be enough to completely cut off the attacker's access.

Vulnerable and patched versions

Ninja Forms: Versions 3.15.3 and older

WPC Product Bundles for WooCommerce: Versions 8.6.6 and older

Upgrade vulnerable plugins to patched versions as soon as possible.

Check admin accounts, installed plugins, and WordPress files to identify suspicious items.

Review security logs for unusual logins and unauthorized administrative activities.

If contamination is detected, remove back doors and hidden accounts and change administrative credentials.