Hidden WordPress Admins: Cleaning Up After the October 2026 Ninja Forms Plugin Attacks

Most WordPress hacks are noisy. Spam goes out, pages get defaced, or the host suspends the account. The campaign reported in early October 2026 against two popular plugins was designed to be quiet, and that makes it worth a careful look if you run either plugin. Here is what was reported, and how I would check and clean a site.

If you would rather have an engineer handle it, Able Rescue for hacked sites is $199 for two hours on the server. Email greg@ableadmins.com or call (832) 977-1356 any hour.

What was reported

BleepingComputer reported on October 6, 2026 that attackers were exploiting stored cross-site scripting flaws in Ninja Forms (CVE-2026-94504, versions 3.15.3 and older) and WPC Product Bundles for WooCommerce (CVE-2026-93836, versions 8.6.6 and older). Ninja Forms is installed on more than 500,000 sites. The campaign was identified by the WordPress security company Patchstack on October 4.

The attack works by planting a script in a form submission or in WooCommerce order data. When a logged-in administrator later opens that entry in the dashboard, the script runs with the administrator's session. According to the report, it then installs a malicious plugin posing as "WP Smart Thumbnails" and sets up four ways back in: a visible administrator account, an administrator account hidden from the WordPress user list, a secret login URL that signs in as the site's oldest administrator, and a file manager reachable through the plugin's main PHP file.

Two details stand out. The hidden account does not appear in the user list or in the totals above it, so the dashboard looks normal. And removing the fake plugin is not enough on its own, because separate helper plugins with backdated timestamps keep the hidden account and secret login working.

First, update the plugins

Update Ninja Forms to 3.15.4 or later and WPC Product Bundles for WooCommerce to 8.6.7 or later. As the report points out, updating stops new exploitation, but it does not clean an existing infection. If your site ran a vulnerable version in October, keep going.

Check users from outside the dashboard

Since the hidden account is invisible in wp-admin, check the database directly. With WP-CLI, wp user list --role=administrator reads accounts from the database. You can also look at the users table in phpMyAdmin and compare the count with what the dashboard shows. Any administrator you cannot account for should be removed, and every remaining administrator password should be reset.

Look past the obvious plugin

• Search the plugins folder, and the must-use plugins folder if you have one, for anything named WP Smart Thumbnails or anything nobody on your team installed.
• Treat file dates with caution. The helper plugins in this campaign were backdated, so an old timestamp does not prove a file is safe.
• Compare plugin folders with clean copies from wordpress.org or the vendor, and reinstall anything you are unsure about.
• Review recent form submissions and WooCommerce orders for unexpected script tags, and delete them before an administrator opens them again.

Close the remaining doors

Reset passwords for WordPress administrators, hosting, FTP or SFTP, and the database user. Rotate the security keys in wp-config.php, which signs everyone out, including any session the attacker still holds. Turn on two-factor authentication for administrators. Then keep a clean backup of the repaired site somewhere other than the server it protects.

Make the next one easier to spot

This campaign relied on an administrator opening a poisoned entry. A few habits reduce that risk: keep form and store plugins updated promptly, limit administrator accounts to the people who truly need them, and use a separate, lower-privilege account for reviewing form entries and orders where your setup allows it. Regular scanning also helps. Our security scans start with an OWASP web scan at $349, with plain-language findings. And Able Watch, at $99 a month, puts a real engineer on the page when your site has trouble.

How Able can help

With Able Rescue, you email or call first, any hour, and pay the $199 as I start. In those two hours I update the affected plugins, check administrator accounts directly in the database, look for the persistence pieces described above, reset access, and give you a plain summary of what I found. If the cleanup runs deeper, I will tell you early and we can plan the rest together.

Sources

• BleepingComputer: Ninja Forms plugin flaw exploited to hack WordPress sites (October 6, 2026)

If you run Ninja Forms or WPC Product Bundles and want a second pair of eyes, email greg@ableadmins.com and we can check it together through Able Rescue.