Develop Better SolutionsBlog

Severity: CriticalDisclosed WordPressWooCommerce

Ninja Forms and WPC Product Bundles flaws used to hide admin accounts: update and check

Attackers used flaws in Ninja Forms and WPC Product Bundles to plant code that creates hidden administrator accounts.

Affects:Ninja Forms 3.15.3 and earlierWPC Product Bundles 8.6.6 and earlier

In September 2026, fixes were published for two flaws that attackers later used in the same campaign. Ninja Forms, a form plugin with more than 500,000 active installations on WordPress.org, fixed its flaw in version 3.15.4 on September 21, 2026 (CVE-2026-94504). WPC Product Bundles for WooCommerce, used on more than 30,000 sites, fixed a similar flaw in version 8.6.7, according to Patchstack (CVE-2026-93836). Patchstack dates the public disclosure of both to September 22.

Both flaws let a visitor without an account hide malicious code in a form submission or a cart request. The code runs later, when an administrator opens that entry in the dashboard. Patchstack observed exploitation starting October 4, 2026 for WPC Product Bundles and October 5 for Ninja Forms. The code then installs a fake plugin called "WP Smart Thumbnails", creates a visible administrator and a hidden one, and adds a secret login link. Removing the plugin does not remove the hidden access.

If your site has updated since then, you are most likely protected against new attacks, but check the version and look for the signs below.

Who is affected

  • Sites running Ninja Forms 3.15.3 or earlier.
  • WooCommerce shops running WPC Product Bundles 8.6.6 or earlier.
  • Any site where an administrator viewed form entries or orders while a vulnerable version was installed.

How to check your site

  1. In WordPress, open Plugins and check the versions of Ninja Forms and WPC Product Bundles for WooCommerce.
  2. Look in Plugins for WP Smart Thumbnails. If it is there, or was there, the site was compromised.
  3. Look in Users for administrators you do not recognise. The hidden account will not appear on that screen, so ask your developer or host to list administrators directly in the database and to check the wp-content/mu-plugins folder.

What to do now

  1. Update Ninja Forms and WPC Product Bundles to their latest versions. Ninja Forms published further security fixes in 3.15.5 and 3.15.6, so do not stop at 3.15.4.
  2. If you find any sign of compromise, have the site cleaned by your host or a security professional. Patchstack lists the files and database entries to remove.
  3. After cleaning, change all administrator passwords, starting with the oldest administrator account, and ask your developer to reset the WordPress security keys.

This alert reports what the sources listed below published and is not a guarantee about any specific site.

Sources