Quick answer: CVE-2026-94504 is a stored cross-site scripting flaw in Ninja Forms versions 3.15.3 and older (500,000+ active installs). Anyone can plant it by submitting a form. It fires when an administrator opens the submission in wp-admin, and the live campaign then installs a fake plugin, creates hidden admin accounts and a backdoor login URL. Update to 3.15.4 or later, then check your Plugins and Users lists, because the update does not remove an existing infection.
This one is not a 9.8. It is rated CVSS 7.1, High. It makes the list anyway, because it is being exploited right now and because of how it gets in: through the most ordinary thing on a business website, the contact form.
What is CVE-2026-94504?
Ninja Forms stores what visitors type into a form and shows it to administrators under Submissions. Versions up to 3.15.3 did not clean that stored content well enough. A visitor can put a script inside a form field, submit it like any other message, and the script sits in your database until someone with admin rights opens that submission. Then it runs in the admin's browser, logged in, with every permission the admin has.
No login is needed to plant it. The person who triggers it is you, doing your job.
The flaw was publicly disclosed on September 22, 2026 and fixed in 3.15.4. The same actor is hitting a second plugin the same way: WPC Product Bundles for WooCommerce (CVE-2026-93836, versions 8.6.6 and older, 30,000+ installs), where the payload goes in through an order parameter and fires when a shop admin opens the order. The fix there is 8.6.7.
What does the attack do once it runs?
Patchstack, which caught the campaign, calls its write-up "Four ways back in", and that is the accurate description. Once the script runs in an administrator's session it fetches the security tokens it needs and installs a malicious plugin that presents itself as "WP Smart Thumbnails" 1.2.4 by "MediaPress Labs". From there it sets up four separate persistence mechanisms:
| Backdoor | What it looks like |
|---|---|
| A visible administrator account | A normal new admin user, with credentials supplied by the attacker's server |
| A hidden administrator account | Username like "support" or "updater", hidden from the Users list by a must-use plugin that filters user queries |
| A secret login URL | /wp-login.php?_wplogin=<token> signs the attacker in as your site's oldest administrator, no password needed |
| An unauthenticated file manager | A web page inside the fake plugin that lets anyone upload, edit and delete files on your server |
Four ways in means that finding and deleting one of them changes nothing. Removing the rogue admin you can see leaves the one you cannot see, the login URL and the file manager all working.
How fast did this go from patch to attack?
Not hours this time, but the pattern is the same: the patch shipped, and the attackers built their tooling while sites stayed unpatched.
| When (UTC) | What happened |
|---|---|
| Sept 22 | Both vulnerabilities publicly disclosed; Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7 available |
| Oct 1 | Attacker registers the domain the payload is served from |
| Oct 2 | Domain moved behind Cloudflare nameservers |
| Oct 4, 10:39 | First exploitation attempt observed, against WPC Product Bundles |
| Oct 5 | Same payload used against Ninja Forms |
| Oct 6 | Patchstack publishes the analysis; BleepingComputer and others report it |
Thirteen days from fix to live attacks. Exploitation is described as "limited" so far, which usually means early. A public proof of concept for the Ninja Forms flaw is already on GitHub.
What should I do today?
- Update. Ninja Forms to 3.15.4 or later. WPC Product Bundles for WooCommerce to 8.6.7 or later. Dashboard → Plugins → Updates.
- Check Plugins for anything called WP Smart Thumbnails or any plugin you did not install. Check
wp-content/mu-plugins/too; must-use plugins do not show up in the normal Plugins list, and that is where the user-hiding code lives. - Check Users. Any administrator you do not recognise, including ones named support, updater or similar. Remember the hidden one will not show in the list while the must-use plugin is active; count admins in the database or ask your host.
- Rotate credentials for every administrator if you find any of the above, and treat it as an incident. Here is what to do in the first hour after a hack.
- Do not open old submissions on a vulnerable version. If you cannot update right now, do not browse the Submissions screen until you have.
Who shouldn't worry too much?
If Ninja Forms updated automatically before October 4 and nobody opened a suspicious submission, you are fine. If you use a different form plugin, this specific bug does not apply to you, although the shape of it does: every form plugin stores untrusted input and shows it to an admin, and this is the second form plugin in this blog since August.
The lesson is not "use a different form plugin". It is that on WordPress your attack surface includes every screen you look at. The update that fixed this was available for thirteen days before the attacks started, which is longer than almost any plugin stays unpatched on a site with auto-updates on. The sites that got hit were the ones where someone still had to do it by hand. If that job is one you would rather not have, here is what leaving costs and what you would move to.
Also this week: WordPress 7.1.3
Two weeks after the critical core flaw, WordPress shipped 7.1.3 on October 6 with seven security fixes and four bug fixes, backported to every supported branch down to 4.7. None of the seven is a remote takeover. The one that needs no login lets a visitor read comments on private or unpublished posts through feeds; the others are a stored XSS on the Comments screen, a denial of service in URL handling, a second-order SQL injection in the export tool, Authors being able to make posts sticky, an XSS through Imgur embeds (Imgur is no longer a trusted embed provider) and a hook-name collision. Sites with background updates on should already have it. Confirm it in Dashboard → Updates.
FAQ
Which Ninja Forms versions are affected by CVE-2026-94504?
Ninja Forms 3.15.3 and older. The fix is in 3.15.4, released on September 22, 2026. All later versions are safe from this specific flaw.
Is CVE-2026-94504 being exploited?
Yes. Patchstack observed the first attacks against WPC Product Bundles on October 4, 2026 and the same campaign against Ninja Forms on October 5. Exploitation was still described as limited on October 6, and a public proof of concept exists.
Does updating Ninja Forms remove the backdoors?
No. The update closes the way in. It does not remove a fake plugin, rogue admin accounts, a must-use plugin or a backdoor login URL that were installed before you updated. Those have to be found and removed by hand or by your host.
Can a visitor take over my site just by submitting the form?
Not on their own. The script needs an administrator to open the submission while logged in. In practice that is what admins do with form submissions, so the gap between "submitted" and "opened" is the only protection an unpatched site has.
Why does a CVSS 7.1 matter when 9.8s are more common?
Because severity scores describe the bug, not the campaign. This one has a working exploit, an active attacker, a half-million-site target and a trigger that is part of normal daily admin work. That combination is more dangerous to a typical business site than a critical flaw nobody is using.
Sources: Patchstack: Four ways back in, the WordPress XSS campaign that hides its own admin account (Oct 6, 2026), BleepingComputer: Ninja Forms plugin flaw exploited to hack WordPress sites (Oct 6, 2026), WordPress 7.1.3 Maintenance and Security Release (Oct 6, 2026), Patchstack: WordPress 7.1.3 Security Release. Details as reported at the time of writing; check the plugin changelogs for current versions.