Four ways back in: the WordPress XSS campaign that hides its own admin account

As cited

Copy frozen at 2026-10-06 12:03 UTC (site build).

vulnerabilities

Four ways back in: the WordPress XSS campaign that hides its own admin account

A coordinated campaign exploits stored cross-site scripting (XSS) vulnerabilities in WordPress plugins to install persistent backdoors. Attackers abuse CVE-2026-93836 in WPC Product Bundles for WooCommerce and CVE-2026-94504 in Ninja Forms to deliver a JavaScript implant that creates hidden administrator accounts, installs an unauthenticated file manager, and establishes magic login tokens. The malware uses legitimate WordPress functions to persist across plugin removal and hide its tracks through must-use plugins and file backdating.

Why it matters: WordPress site administrators running WPC Product Bundles through version 8.6.6 or Ninja Forms through version 3.15.3 face immediate risk of undetectable account compromise and persistent backdoor access; update both plugins immediately and search for the dropped wp-smart-thumbnails plugin and must-use plugin files in /wp-content/mu-plugins/.

Source published

2026-10-06 08:59 UTC

First seen by Cybersecurity Tracker

2026-10-06 10:30 UTC