Attackers are exploiting a Ninja Forms vulnerability to plant hidden admin accounts on WordPress sites. The plugin runs on more than 500,000 sites, so the pool of targets is huge. Researchers logged the first attempts on 4 October 2026, and the campaign is still live.
The Ninja Forms vulnerability matters far less than what attackers do once they are through it. One successful hit leaves four separate ways back into the site. Only one shows up in the dashboard, so owners who patch and move on stay compromised.
How attackers exploit the Ninja Forms vulnerability
Ninja Forms lets site owners build contact forms without writing code. The Ninja Forms vulnerability affects every version up to 3.15.3 and carries the ID CVE-2026-94504. Older builds save what a visitor types, then print it on the admin screen without stripping dangerous code.
So an attacker fills in a form and buries JavaScript in one of the fields. The site stores it like any other message. Nothing fires until someone with admin rights opens that submission, which staff do every day. The moment the page loads, the script runs inside the admin’s own browser.
A second plugin carried the same payload a day earlier: WPC Product Bundles for WooCommerce, with another 30,000 installs. Both bugs score 7.1 on the CVSS scale. Neither one needs the attacker to log in first, which widens the attack surface well beyond registered users.
Why stored XSS works so well here
The script never steals a password or a cookie. Because it runs on the site itself, its requests to the admin area carry the logged-in session. It scrapes the security tokens WordPress uses to approve admin actions, then replays them. HttpOnly protection buys nothing here, since the code never reads the cookie at all.
Four doors into the same site
Once the payload from the Ninja Forms vulnerability fires, it installs a fake plugin called WP Smart Thumbnails. The listing claims version 1.2.4 from MediaPress Labs. Neither the plugin nor the vendor is real. From there the malware opens four separate routes in:
- A visible admin account, created through the normal WordPress user screen.
- One hidden admin account, stripped from the Users list entirely.
- A secret login link that signs the holder in as the site’s oldest admin.
- An unauthenticated file manager, reachable by direct request to the fake plugin.
Deleting the fake plugin closes exactly one of those doors. The hidden account and the secret link live in must-use plugins, a folder that loads on every request and never shows on the Plugins screen. Most cleanup routines never look there.
The admin account you cannot see
The hidden account is the sharpest trick in this campaign. A small must-use plugin hooks the database query behind the Users page and strips the account out. It also drops the account from the Administrator filter and lowers the role counts above the list. Your dashboard says three admins when you really have four.
The secret login link follows the same logic. It does not sign the attacker in as the fake account. Instead it hands them a session as the oldest admin, so logs recording only a user ID see the owner at work.
Why patching the Ninja Forms vulnerability is not enough
Updating to Ninja Forms 3.15.4 blocks fresh injection attempts, and WPC Product Bundles users should move to 8.6.7. But an update does nothing about code already sitting on the server. If an admin opened a poisoned submission first, the Ninja Forms vulnerability has already done its work.
The malware also fights forensics. It stamps every dropped file with the oldest date in the WordPress root, so implants look older than the site. Hunting for recently changed files turns up nothing, and each must-use plugin uses a fresh key per site.
What to check right now
The Ninja Forms vulnerability leaves your dashboard lying about who holds access, so start in the database. Query the users table directly for accounts holding admin rights, then compare that list against the Users page. Any account in one and not the other is a hidden admin.
Next, open the mu-plugins folder and look for class-wp-token-validate.php or class-wp-query- plus eight hex characters. Check the options table for fz_emer_done_v1 and fz_emer_login_tokens. Then search server logs for calls to imgcdn1.com and for hits on wp-login.php carrying a _wplogin parameter. Sites hit by the Ninja Forms vulnerability show at least one of these traces.
Locking down admin access
Cleanup only sticks if the credentials you rotate stay private. The secret link signs in as the oldest admin, so treat that password as burned. Rotate every privileged password and regenerate your WordPress authentication salts.
The Ninja Forms vulnerability hands attackers an admin session for free, so protect the real ones. Plenty of owners log into wp-admin from cafés, airports and shared offices. A VPN encrypts that connection, so session cookies and login details stay unreadable to anyone on the same Wi-Fi. It will not stop a stored XSS attack, but it does close one easy path to privileged access.
Final Thoughts
Attackers now collect stored XSS bugs the way other crews collect stolen passwords. The follow-up code cares nothing about which plugin let it in, so the same implant will surface through new flaws. This Ninja Forms vulnerability just happens to carry half a million installs behind it.
Patch today if you have not already, but treat that as step one. Any site where an admin viewed a submission this week deserves a look at its user table, mu-plugins folder and logs. The dashboard no longer counts as a reliable witness, so verify everything underneath it.
