Ninja Forms plugin flaw exploited to hack WordPress sites
-
Attackers are actively exploiting stored cross-site scripting (XSS) flaws in two unrelated WordPress plugins — Ninja Forms and WPC Product Bundles for WooCommerce — to plant backdoors and create rogue administrator accounts on vulnerable sites.
The Ninja Forms flaw is being used in live campaigns, with threat actors leveraging the XSS to inject malicious scripts that persist on compromised pages. Because the injection is stored, the payload executes for any visitor loading the affected content, giving attackers a foothold to escalate access. In parallel, the WPC Product Bundles for WooCommerce vulnerability is being abused for the same purpose, despite the two plugins having no connection to one another.
Once exploitation succeeds, the attackers move to establish persistence and control:
- Deploying backdoors for continued access
- Creating unauthorized admin accounts
- Maintaining long-term control over the compromised WordPress installation
Site operators running either plugin should treat this as an active threat. Given the nature of stored XSS, simply removing visible malicious content is not enough — a full compromise assessment is warranted.
Neither the article nor the advisory provides a specific CVE identifier for either flaw, so no CVE is cited here. Administrators should check vendor advisories and update both plugins to their latest patched versions as a priority.
Source: Bleeping Computer
If your organization runs either of these plugins, have you already patched and audited for rogue admin accounts?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login