Attackers are running a WordPress campaign that does not stop at code execution. It plants four separate ways back into the site, and three of them survive removing the vulnerable plugin.
What happened
Two stored cross-site scripting flaws in unrelated plugins carry the same payload. CVE-2026-94504 affects Ninja Forms through 3.15.3, where an anonymous textarea submission is rendered without safe encoding in the legacy submission editor. CVE-2026-93836, rated 7.2, affects WPC Product Bundles for WooCommerce through 8.6.6, where a quantity value with a numeric prefix passes validation while keeping a script tag that lands in order metadata.
Patchstack recorded the first attempt against WPC Product Bundles on 4 October 2026 and the same payload through Ninja Forms a day later. The script runs in the browser of a logged-in administrator, scrapes the plugin-upload nonce, pulls a ZIP from attacker infrastructure and installs a plugin posing as a thumbnail cache. The package also creates a visible administrator, a second administrator hidden from the Users screen, a secret login URL that authenticates as the site's original owner, and a file manager reachable without a password. Its files are backdated by months.
Fixes shipped before the attacks started: WPC Product Bundles 8.6.7 and Ninja Forms 3.15.4. Updating closes the entry point and removes none of the persistence.
Who is affected
- Any WordPress site running Ninja Forms 3.15.3 or earlier, an installed base of more than 500,000 sites.
- Sites running WPC Product Bundles for WooCommerce 8.6.6 or earlier, roughly 30,000 stores.
- Any site where an administrator opened an order or form submission between 4 October and now, since that is when the implant installs.
What to do now
Update both plugins first, then look for the implant, because the update alone leaves the attacker's accounts and backdoor URL in place.
- Update Ninja Forms to 3.15.4 or later and WPC Product Bundles to 8.6.7 or later.
- Check for a directory named wp-smart-thumbnails under wp-content/plugins. It is fake, and its real payload lives in emer-run.php.
- Query the database directly for administrator accounts, since the hidden one does not appear in the dashboard user list.
- Search web server and application logs for requests to imgcdn1.com, /fz/x.js and /fz/c.php.
- If any of the above hits, treat the site as compromised: reset administrator credentials, rotate database and API secrets, and rebuild from a known-clean backup.
What this means for South African businesses
Most local SMEs treat a plugin update as the whole fix, and this campaign is built to punish exactly that habit: a patched site can still be fully owned weeks later. Small marketing and e-commerce sites are the realistic target here, because form builders and WooCommerce add-ons are installed casually and rarely inventoried. If your site runs either plugin and nobody has checked the database for rogue administrators, assume the exposure is live until proven otherwise.
Source: Patchstack's analysis of the WordPress XSS persistence campaign.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.