Published on October 14, 2026 · The mitza.es team
In the first week of October 2026, the security firm Patchstack detected active exploitation of flaws in three WordPress plugins. Two of them, Ninja Forms and WPC Product Bundles for WooCommerce, are part of the same campaign, which leaves backdoors on the site. The third, Bricksforge, lets an attacker run code without even logging in. Ninja Forms has more than 500,000 active installations, so this is no niche plugin: plenty of SME websites use it for their contact form.
Ninja Forms and WPC Product Bundles: a campaign that leaves hidden administrators
Both flaws are stored cross-site scripting bugs rated high severity: CVE-2026-94504 in Ninja Forms (versions 3.15.3 and earlier, fixed in 3.15.4) and CVE-2026-93836 in WPC Product Bundles (versions 8.6.6 and earlier, fixed in 8.6.7, with more than 30,000 installations). Patchstack saw the activity against WPC Product Bundles on October 4 and against Ninja Forms the next day; BleepingComputer published it on the 6th.
The attack works like this: the attacker plants a fragment of malicious JavaScript in the data of a WooCommerce order or in a Ninja Forms submission. Nothing happens until an administrator who is logged in opens that content in the dashboard. At that moment the script runs with the administrator's permissions, installs a fake plugin called «WP Smart Thumbnails» (version 1.2.4, from «MediaPress Labs») and creates administrator accounts. Because the malicious code comes from the same domain in both cases, BleepingComputer attributes it to a single actor. Patchstack describes the exploitation as limited for now.
The most uncomfortable part is that each attack leaves several ways back in: a visible administrator account, a hidden one, a secret login URL that signs in as the oldest administrator, and an unauthenticated file manager inside the fake plugin. That's why BleepingComputer insists that updating prevents new infections but doesn't clean a site that is already compromised.
Bricksforge: unauthenticated file upload and CVSS 10
CVE-2026-85097 affects Bricksforge versions 3.1.8.9 and earlier, an add-on for the Bricks builder, and is fixed in 3.1.8.10. An attacker with no account can upload a file disguised as an image that actually contains PHP code and run it on the server. Patchstack scores it CVSS 10.0 (SecurityWeek puts it at 9.8) and recorded the first exploitation attempts on October 7, 2026, at 21:47 UTC, with automated traffic coming from 63 different IP addresses.
SecurityWeek estimates the plugin is used on around 6,000 websites, a much smaller figure than Ninja Forms, but the severity of the flaw and the speed of the attack justify the urgency. Patchstack has also published a mitigation rule for anyone who can't update right away.
How to tell whether your site is affected
- Check the plugins screen for the versions of Ninja Forms, WPC Product Bundles and Bricksforge you have, and compare them with the fixed ones.
- Look for the plugin «WP Smart Thumbnails» 1.2.4: it shouldn't be anywhere in your installation.
- Review your administrators, but not only on the Users screen of the dashboard, because one of the accounts may be hidden: also check the users table directly in the database.
- If you use Bricksforge, look for unexpected PHP files in the WordPress uploads folder, especially in
/wp-content/uploads/bricksforge/tmp/and files namedlogin_admin_*.php. - Also check the
wp-content/mu-pluginsfolder: any file you didn't put there yourself deserves an explanation.
If you find anything, updating isn't enough. The sensible course is to restore a backup from before October 4, change the passwords of all administrators, starting with the oldest one, and renew the security keys in wp-config.php. If you don't have a clean backup, it's worth having someone experienced review the site before you consider it recovered.
Why plugins are WordPress's weak link
This pattern keeps repeating. Last month WordPress core itself had its own warning with the critical flaw CVE-2026-87902, and in early September we covered the critical Elementor Pro vulnerability. Every plugin is third-party code with its own patch schedule, and the longer a site takes to update, the longer it stays exposed to a flaw that already has a published fix.
What to do from today
Update all three plugins if you use them, and deactivate and delete the ones you don't need: a plugin that isn't installed can't be attacked. If you'd rather not deal with it yourself, our website maintenance service takes care of updates, backups and monitoring, and in the guide to what a maintenance plan includes we explain how to compare proposals. For a one-off review of a site that worries you, our website security audit checks plugins, users and configuration, and if your site depends on too many add-ons, we can also scope a custom build with fewer third-party pieces.