Cybersecurity researchers have uncovered a sophisticated, stealth-focused attack campaign targeting WordPress sites. The operation exploits Stored Cross-Site Scripting (XSS) vulnerabilities in two popular plugins—Ninja Forms and WPC Product Bundles for WooCommerce—to silently install an invisible administrative account and leave behind up to four distinct vectors for future unauthorized access.

According to a comprehensive technical analysis published by security firm Patchstack, the first malicious payloads associated with this campaign were detected on October 4, 2026. What makes this campaign particularly dangerous is that simply updating the vulnerable plugins is entirely insufficient to neutralize the threat. If the exploit successfully executed prior to patching, persistent backdoors remain active deep within the core architecture of the website, completely hidden from the site owner.

Main Facts: Anatomy of a Stealthy Compromise

The campaign leverages two distinct, unauthenticated Stored XSS entry points that were publicly disclosed on September 22, 2026. Despite differing initial vectors, both vulnerabilities funnel the target into loading the exact same malicious JavaScript payload (x.js) hosted on the attacker-controlled domain imgcdn1.com.

The Entry Vectors

1. WPC Product Bundles for WooCommerce (CVE-2026-93836): Affecting versions up to and including 8.6.6. The plugin improperly validates numeric quantity inputs, allowing attackers to append arbitrary malicious code. This string is stored directly within WooCommerce order metadata and subsequently rendered without proper filtering.
2. Ninja Forms (CVE-2026-94504): Affecting versions up to and including 3.15.3. The plugin captures form field submissions and outputs them unencoded inside the legacy dashboard shipping submissions editor.

Because these vulnerabilities involve Stored XSS rather than reflected XSS, attackers do not need to trick administrators into clicking malicious links. The malicious payload is already embedded within everyday operational data—such as a customer order or a form submission—that an administrator routinely reviews. The script automatically executes the moment the administrator views the entry.

Post-Exploitation Mechanics

Once executed in the browser of an authenticated administrator, the malicious x.js script does not waste time attempting to steal session cookies. Instead, it operates directly within the active administrative session.

The script scrapes internal dashboard pages for security tokens (nonces) required for administrative actions, leveraging them to silently execute operations. It communicates with an external command-and-control server to track completion milestones and stores its progress locally within the browser.

Next, the script utilizes the native WordPress plugin installer to covertly upload a malicious plugin disguised as a legitimate tool: WP Smart Thumbnails 1.2.4 (falsely attributed to MediaPress Labs, utilizing the slug wp-smart-thumbnails).

• The Covert File Manager: The primary file of this fake plugin utilizes inverted logic—instead of blocking direct script access, it executes only when called directly by an external source. It conceals an advanced file manager behind seven layers of obfuscation, devoid of any password protection or access controls. Anyone possessing the correct URI path gains total, unauthenticated read, write, and delete capabilities over the entire server environment.
• Stealth Persistence: The package includes a second crucial file, emer-run.php, designed to secure long-term persistence. It programmatically provisions a new administrative account utilizing innocuous names (such as support, updater, maintenance, or backup) paired with a deceptive @wordpress.org email address.

The Four Backdoor Vectors

A single successful execution leaves the attacker with four independent paths back into the compromised environment, only one of which is visible through standard operational channels:

1. The Hidden Administrator Account: Fully privileged, yet completely invisible within the WordPress user interface.
2. The Obfuscated File Manager: Hosted via the faux wp-smart-thumbnails plugin for arbitrary file modification.
3. Must-Use (MU) Plugins: Two backend system plugins designed to bypass normal administrative controls.
4. Magic Authentication URLs: A backdoor login mechanism that bypasses standard credentials entirely.

Chronology of the Campaign

Understanding the timeline of this campaign highlights the speed at which threat actors weaponize newly disclosed vulnerabilities and construct dedicated operational infrastructure.

• September 22, 2026: Vulnerabilities in Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836) are publicly disclosed to the security community.
• October 1, 2026: The domain imgcdn1.com—subsequently identified as the primary delivery mechanism for the malware’s JavaScript payloads—is officially registered, aligning precisely with the deployment phase of the campaign infrastructure.
• October 4, 2026, 10:39 UTC: Patchstack telemetry systems record the first active exploitation attempts targeting the WPC Product Bundles vulnerability.
• October 5, 2026: The exact same malicious codebase begins appearing via the Ninja Forms vulnerability vector, confirming a coordinated, multi-plugin campaign controlled by a single threat actor entity.

Supporting Data and Technical Indicators

The sophistication of this campaign lies in its anti-forensic and persistence techniques, which intentionally subvert standard administrative audits and file-integrity monitoring tools.

The Role of Must-Use (MU) Plugins

To ensure the stealth administrator and backdoors survive routine security checks, the malware drops two Must-Use plugins directly into the /wp-content/mu-plugins/ directory:

• class-wp-query-<8 characters>.php: This script systematically intercepts database queries concerning user lists. It actively strips the stealth administrator account from the standard user dashboard view, user count metrics, and administrative filters.
• class-wp-token-validate.php: This script establishes a specialized "magic link" backdoor URL. When triggered, it automatically authenticates the visitor as the oldest legitimate administrator on the site (typically the original site owner), bypassing multi-factor authentication and password checks.

MU plugins load automatically on every single WordPress request, cannot be deactivated via the WordPress dashboard, and do not appear on the standard installed plugins screen. Furthermore, the malware authors dynamically obfuscate these scripts using unique cryptographic keys for every infected site—preventing security scanners from relying on static signatures. To defeat file-mtime forensic audits, the modification timestamps of these malicious files are explicitly altered to match the oldest file found within the target WordPress installation.

Network and Infrastructure Footprint

• Primary Delivery Domain: imgcdn1.com
• Common Payload Paths: /fz/x.js, /fz/c.php
• Targeted Directories: /wp-content/plugins/wp-smart-thumbnails/, /wp-content/mu-plugins/
• Operational Attribution: Analysis of the IP addresses routing the attacks reveals that at least four out of five identified source nodes belong to the Tor anonymity network, rendering simple IP-blocking strategies ineffective as a long-term defense mechanism.

Official Responses and Remediation Guidelines

Given that foundational persistence mechanisms remain intact even after removing vulnerable software, Patchstack urges site administrators to treat any exposed installation as a fully compromised system.

Step-by-Step Cleaning and Remediation Protocol

1. Immediate Software Updates:

   • Update WPC Product Bundles for WooCommerce to version 8.6.7 or higher.
   • Update Ninja Forms to version 3.15.4 or higher.

2. Review Server Access Logs:

   • Inspect web server access logs for references to imgcdn1.com, /fz/x.js, and /fz/c.php.

3. Database Audit for Hidden Administrators:
   Because malicious MU plugins hide unauthorized accounts from the WordPress dashboard, administrators must query the underlying database directly using tools like phpMyAdmin. Execute the following SQL query (adjusting the table prefix wp_ if custom prefixes are used):

   SELECT u.user_login, u.user_email, u.user_registered
   FROM wp_users u
   JOIN wp_usermeta m ON m.user_id = u.ID
   WHERE m.meta_key = 'wp_capabilities'
   AND m.meta_value LIKE '%administrator%';

   Any account appearing in the database query result that is missing from the WordPress dashboard user interface has been concealed by the malware. Look closely for suspicious email domains (such as @wordpress.org) and generic usernames like support, updater, maintenance, or backup.

4. File System Cleanup:

   • Permanently delete the directory /wp-content/plugins/wp-smart-thumbnails/.
   • Inspect /wp-content/mu-plugins/ and remove any unauthorized or suspicious PHP files, particularly those matching patterns like class-wp-query-*.php and class-wp-token-validate.php.

5. System-Wide Hardening:

   • Force-reset passwords for all legitimate administrative users.
   • Change all WordPress security cryptographic keys and salts (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, etc.) in the wp-config.php file to invalidate all active session tokens across the entire site.
   • Review database options and tables for unauthorized changes or injected options.
   • For a comprehensive system restoration, utilize industry-standard security hardening frameworks, such as structured multi-point site cleaning methodologies.

Implications for the WordPress Ecosystem

This campaign marks an evolutionary leap in automated WordPress exploitation. Historically, many Stored XSS attacks focused on opportunistic, noisy vandalism or rapid spam injection. This campaign demonstrates a surgical approach: leveraging UI-layer trust to silently establish deep, resilient persistence that survives standard software updates and evades visual inspection.

With Ninja Forms powering over 500,000 active installations and WPC Product Bundles exceeding 30,000, the potential attack surface is vast. Security analysts warn that because the core implantation mechanism relies generically on leveraging Stored XSS to seize control of active administrator sessions, threat actors will likely adapt these scripts to exploit newly discovered vulnerabilities in other widely used plugins.

Website administrators are strongly advised to implement robust Web Application Firewalls (WAFs), maintain strict principle-of-least-privilege user management practices, and perform regular, deep-file integrity audits beyond standard dashboard notifications.