CVE-2026-93836Active Exploitation

🚨 HACKERS EXPLOIT NINJA FORMS AND WPC PRODUCT BUNDLES XSS FLAWS TO PLANT HIDDEN WORDPRESS ADMINS Patchstack reports an active campaign abusing two stored XSS bugs in unrelated WordPress plugins, both delivering the same JavaScript payload from imgcdn1[.]com. • CVE-2026-94504: Ninja Forms ≤ 3.15.3 (500K+ installs), fixed in 3.15.4 • CVE-2026-93836: WPC Product Bundles for WooCommerce ≤ 8.6.6 (30K+ installs), fixed in 8.6.7 • Both rated CVSS 7.1; the payload is injected without login and fires when an admin views the poisoned submission or order • It installs a fake "WP Smart Thumbnails" plugin, creates a visible admin plus one hidden from the Users screen, adds a secret login URL and an unauthenticated file manager • First seen Oct 4 (WPC) and Oct 5 (Ninja Forms) ⚠️ Analyst Note: Patchstack says exploitation is limited so far, and neither CVE is in CISA KEV at handoff. Updating stops new infections but does not remove an existing one: check for unknown admins, must-use plugins and the fake thumbnail plugin. Primary: https://patchstack.com/articles/four-ways-back-in-the-wordpress-xss-campaign-that-hides-its-own-admin-account/ #DDW #DarkWeb #CyberSecurity #WordPress #CVE #PatchNow

Two WordPress stored XSS flaws are being chained to plant hidden admin accounts. CVE-2026-94504 has a public exploit, while CVE-2026-93836 has no known public exploit. Both are CVSS 7.2. #WordPress #CyberSecurity https://t.co/nJiTSWuexf

WordPress Sitelerinde Ninja Forms Açığı Üzerinden Saldırılar Başladı WordPress sitelerinde kullanılan Ninja Forms ile WPC Product Bundles for WooCommerce eklentilerindeki yüksek önem dereceli XSS açıkları saldırılarda kullanılmaya başlandı. CVE-2026-94504 ve CVE-2026-93836 olarak izlenen açıklar, oturum açmış kullanıcıların gerçekleştirebildiği sa https://www.cozumpark.com/wordpress-sitelerinde-ninja-forms-acigi-uzerinden-saldirilar-basladi

Active attack on 530,000+ WordPress sites: Ninja Forms and WPC Product Bundles XSS. → Unauthenticated stored XSS (CVE-2026-94504 and CVE-2026-93836), exploited in the wild per Patchstack → The payload waits in a form entry or order until an admin opens it → It rides the admin's session, so it never needs to steal a cookie → One hit can leave four ways back in, including a hidden admin → Run Ninja Forms 3.15.5 (not just 3.15.4) and the latest WPC Product Bundles (8.7.3) → Check with SQL and the file system, not the Users screen, then rotate salts and credentials https://magicwp.io/blog/ninja-forms-wpc-product-bundles-xss-campaign

WordPressのフォームに仕込んだ1行で、管理者が作られる攻撃が実際に起きていたのでメモ。 何が起きたか ・Ninja Forms（CVE-2026-94504）と WPC Product Bundles（CVE-2026-93836）、どちらも保存型XSS ・問い合わせ内容や注文データに不正なJavaScriptを保存しておく ・管理者が管理画面でそれを開いた瞬間、本人のセッションで実行される ・裏で偽プラグインの導入、隠し管理者の作成、秘密のログインURL設置まで走る 影響を受ける条件 ・Ninja Forms は50万サイト以上、WPC は3万サイト以上が利用 ・Patchstackが10/4〜5に実際の攻撃を観測 今すぐやること ・Ninja Forms は 3.15.4、WPC は 8.6.7 以上に更新 ・DBを直接見て、身に覚えのない管理者がいないか確認 ・mu-plugins フォルダと、最近の不審なプラグインもチェック まとめ 更新しても、すでに入った裏口や偽管理者は残ります。フォーム系を使ってるサイトは、更新とあわせて管理者一覧を一度洗っておくのが安全です。

🛡️ CYBER BULLETIN | 2026/10/07 🚨 1) Atlassian disclosed CVE-2026-21589 (CVSS 9.3), a critical flaw in 8 self-hosted Data Center products, including Jira, Confluence and Bitbucket. An attacker with no login can read specific files in the app's web root, as long as they know the exact file name and path. There's no known exploitation yet and Cloud is already patched. If you run Data Center, upgrade to the fixed version now. If you can't, cut off outside access or add the WAF or rewrite rules from the advisory, and check your logs for traversal patterns. 2) Attackers are exploiting stored XSS flaws in two WordPress plugins: Ninja Forms (CVE-2026-94504, 500k+ sites) and WPC Product Bundles for WooCommerce (CVE-2026-93836). They plant JavaScript in form submissions or order data. When an admin opens it, the script installs a fake "WP Smart Thumbnails" plugin and creates a hidden admin account that doesn't show up in the user list. Update to Ninja Forms 3.15.4 or WPC Product Bundles 8.6.7, then look for that plugin and odd admin logins, because updating won't clean an existing infection. 3) A malicious spreadsheet can make LibreOffice and Apache OpenOffice run attacker code as soon as it's opened, with no macro warning, if Java support is on. It chains normal features: an auto-refreshing database range pulls a remote database file, which loads a Java driver from the attacker's server. It's only a proof of concept so far. LibreOffice fixed it (CVE-2026-63277) in 26.2.5 and 26.8.0, but OpenOffice 4.1.16 and earlier are still unpatched (CVE-2026-59265). Update LibreOffice, or turn off Java in OpenOffice until 4.1.17 ships. 4) ASOS confirmed a breach after hackers pushed "ASOS HACKED" notifications to its app users on Tuesday. The group claims it stole data from the retailer's Snowflake environment, which ASOS hasn't confirmed. The company says names and contact details may be exposed, but not card details or passwords. If you shop with ASOS, ignore links in unexpected messages and expect phishing that uses your real name. 5) The FBI says a contractor's missed security patch led to the ShinyHunters breach that exposed data on thousands of bureau employees, and it has removed that contractor. Reuters' sources say it was Accenture and the system was Oracle PeopleSoft, which the group has been targeting. If a vendor runs your HR or PeopleSoft platform, ask them for proof that the latest patches are installed. Who checks that your vendors actually install the patches they promise? #CyberSecurity #InfoSec

En WordPress puede haber un administrador que no ves: Patchstack reporta explotación de fallas XSS en Ninja Forms (CVE-2026-94504, más de 500.000 sitios) y en WPC Product Bundles para WooCommerce (CVE-2026-93836) para dejar administradores ocultos en la lista de usuarios. Cómo funciona, según BleepingComputer (6 de octubre): - Ambas fallas requieren una sesión autenticada. El atacante mete JavaScript (x.js, servido desde imgcdn1[.]com) en datos de pedidos de WooCommerce o en envíos de Ninja Forms. - Cuando un administrador abre ese contenido, el script usa su sesión para instalar un plugin falso, "WP Smart Thumbnails" 1.2.4 de "MediaPress Labs", y crear un administrador. - Deja cuatro puertas: un admin visible, un admin oculto que no aparece en Usuarios ni en los conteos, una URL secreta que entra como el administrador más antiguo y un gestor de archivos sin autenticación. - Si borras el plugin falso, la cuenta oculta y la URL secreta siguen funcionando, gracias a plugins auxiliares con fechas alteradas. Qué hacer: 1. Actualiza Ninja Forms a la 3.15.4 o superior y WPC Product Bundles a la 8.6.7 o superior. 2. Busca "WP Smart Thumbnails" y cualquier plugin que no reconozcas, aunque parezca viejo. 3. Revisa los administradores directamente en la base de datos (tablas de usuarios y sus metadatos), no solo en el panel. 4. Busca imgcdn1[.]com en pedidos, envíos de formularios y registros. Actualizar evita nuevas entradas, pero no limpia una infección. Patchstack dice que, por ahora, la explotación es limitada. La campaña la detectó el 4 de octubre.

ExploitGrid tracks CVE-2026-94504 at 36.9/100 and CVE-2026-93836 at 28.9/100. CVE-2026-94504: https://exploitgrid.net/vulnerabilities/CVE-2026-94504 CVE-2026-93836: https://exploitgrid.net/vulnerabilities/CVE-2026-93836 Patch affected plugins and check for compromise.

CVE-2026-93836 WooCommerce WPC Product Bundles stored XSS via qty param, CVSS 7.2, unauthenticated, no patch yet. Update now: https://www.valtersit.com/cve/CVE-2026-93836 #CVE #infosec #WordPress #WooCommerce #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

CVE-2026-93836 The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including… https://www.cve.org/CVERecord?id=CVE-2026-93836