Hackers are exploiting flaws in Ninja Forms and WPC Product Bundles for WooCommerce to gain persistent access to WordPress websites. The attacks use malicious scripts hidden in form submissions or order data, where they can run when an administrator views the content. Site owners should update both plugins and check for signs of an existing infection.
Key takeaways
- The flaws affect Ninja Forms 3.15.3 and earlier, and WPC Product Bundles for WooCommerce 8.6.6 and earlier.
- Attackers can use the vulnerabilities to install a malicious plugin and create administrator access that may be difficult to spot.
- Update to Ninja Forms 3.15.4 or later and WPC Product Bundles 8.6.7 or later, then investigate for compromise.
A WordPress maintenance plan can help keep plugins current, but patching alone will not remove malicious code already on a site.
How the attacks work
Both issues are stored cross-site scripting (XSS) vulnerabilities. The attacker places JavaScript in WooCommerce order data or Ninja Forms submissions. If a logged-in administrator opens the affected content, the script runs in their authenticated session and can use WordPress functions to make changes.
The campaign was first identified on October 4 against users of WPC Product Bundles for WooCommerce, with similar activity targeting Ninja Forms the following day. The same JavaScript delivery infrastructure appeared in both attacks, suggesting they were carried out by the same threat actor. Exploitation requires an authenticated session, and researchers described activity as limited at the time of reporting.
Hidden access can outlast the malicious plugin
The payload installs a plugin called “WP Smart Thumbnails,” presented as version 1.2.4 from “MediaPress Labs,” and creates administrator access. Researchers found several ways the attackers could retain control: a visible admin account, a hidden admin account, a secret login route and a file manager accessible through a direct request.
The hidden account may not appear in the WordPress user list or administrator filters. The file manager cannot run commands, but it could be used to add further malicious files. Separate auxiliary plugins may also preserve the hidden account and secret login route, even if the main malicious plugin is removed.
What WordPress site owners should do
Update Ninja Forms to version 3.15.4 or later and WPC Product Bundles for WooCommerce to version 8.6.7 or later. Then review administrator accounts, installed plugins and unfamiliar files or login routes. Removing the vulnerable plugin or installing its update prevents further exploitation through that flaw, but does not clean an existing infection.
If you find suspicious access or cannot verify that the site is clean, seek help from a WordPress security professional. Regular plugin updates, account reviews and recovery checks are useful parts of a WordPress care plan—and can help catch problems before they become a longer-term compromise.
- Ninja Forms plugin flaw exploited to hack WordPress sites, BleepingComputer.