Ninja Forms & WPC Product Bundles Plugins Exploited via Stored XSS to Create Rogue Admin Accounts
What Happened — Researchers observed a coordinated campaign that leverages stored cross‑site scripting (XSS) flaws in two popular WordPress plugins—Ninja Forms (CVE‑2026‑94504) and WPC Product Bundles for WooCommerce (CVE‑2026‑93836). The payload runs in the browser of a logged‑in administrator, harvests WordPress nonces, installs a malicious “WP Smart Thumbnails” plugin and creates hidden administrator accounts that persist even after the malicious plugin is removed.
Why It Matters for Trust & Control Assurance
- Demonstrates how a single client‑side code injection can bypass normal access‑control checks and give attackers persistent privileged access—exactly the scenario a continuous access‑control assurance program must detect and evidence.
- Highlights the need for real‑time monitoring of privileged‑account creation and for immutable audit logs that can prove when an admin account was added, modified, or hidden.
- Shows that timely patching of third‑party components is a core control; without documented patch‑management evidence, organizations struggle to prove due‑diligence to auditors.
Who Is Affected – Any organization that runs WordPress sites with the vulnerable plugins, spanning e‑commerce, professional services, SaaS portals, and media sites.
Recommended Actions
- Immediately upgrade Ninja Forms to ≥ 3.15.4 and WPC Product Bundles for WooCommerce to ≥ 8.6.7.
- Conduct a forensic review of all admin accounts (including hidden ones) and remove any that were not created through approved processes.
- Enable immutable logging of user‑account changes and integrate those logs into a continuous control‑monitoring solution.
Technical Notes – The vulnerabilities are stored XSS (requires an authenticated admin session). Exploited payload injects JavaScript that harvests WordPress nonces, calls core functions to install a malicious plugin, and creates four persistence mechanisms (visible admin, hidden admin, secret login URL, unauthenticated file manager). Source: https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/