Ninja Forms Vulnerability: Hackers Are Hiding Fake Admins on WordPress Blogs

Affiliate disclosure: TopTierBlogHost earns a commission when you buy hosting through links on this page. It never changes what you pay, and it never changes which host we recommend. We write up the bad news about our own affiliate partners too.

On October 4 and 5, 2026, security researchers at Patchstack recorded the first live exploitation of two WordPress plugin flaws that had been publicly disclosed two weeks earlier. The attack is not a defacement and not a redirect. It quietly creates an administrator account on your blog, hides that account from the Users screen, and leaves three more ways back in even after you delete the plugin that let the attacker through.

One of the two plugins is Ninja Forms, which is active on more than 500,000 WordPress sites. If you run a blog with a contact form, there is a reasonable chance you are on that list. This post explains exactly what the Ninja Forms vulnerability is, how to tell in about five minutes whether your blog was touched, and what to do if it was.

What the Ninja Forms vulnerability actually is

Both flaws in this campaign are unauthenticated stored cross-site scripting, usually shortened to stored XSS. “Unauthenticated” is the part that matters for a blogger. It means the attacker does not need an account on your site, does not need a password, and does not need to guess one. They submit something through a public-facing form, and the malicious code is saved into your database.

The payload then sits there and waits. It fires when a logged-in administrator opens the screen where that saved content is displayed — in the Ninja Forms case, the admin screen where you read your form submissions. Your browser runs the attacker’s JavaScript with your administrator session attached to it. From the server’s point of view, every action that follows was performed by you.

That is why this class of bug is more dangerous than its severity score suggests. A 7.1 CVSS rating sounds mid-range. The practical outcome is full administrative control of your blog.

The two plugins affected

Both vulnerabilities were publicly disclosed on September 22, 2026. The Ninja Forms fix actually shipped the day before disclosure: version 3.15.4 was released on September 21, 2026, and its changelog credits researcher Venkateswara Reddy Challa for the report, describing the fix as strengthened output escaping on the admin submission edit screen. The current release at the time of writing is 3.15.5, from September 28, 2026.

WPC Product Bundles for WooCommerce patched in 8.6.7, with a changelog entry crediting a researcher working with Wordfence. That plugin is now on 8.7.4.

So the patches have existed for more than two weeks. The sites being compromised right now are the ones that did not install them.

Why deleting the plugin does not fix it

This is the part most “we got hacked” guides get wrong, and it is the reason this particular campaign is worth a dedicated post.

Once the payload runs in an administrator’s browser, it installs four independent ways back into the site. Patchstack’s write-up documents all four. Removing the vulnerable plugin closes the door the attacker came through. It closes none of the three doors they built on the way in.

1. A visible administrator account

The script submits WordPress’s own user-new.php form to create an administrator, using a username and password handed down by the attacker’s command-and-control server. This one you can actually see. It will be sitting in your Users list looking like it belongs there.

2. A hidden administrator account

A second administrator is created with a random name and password. A must-use plugin — a file dropped into wp-content/mu-plugins/ named along the lines of class-wp-query-<8 hex characters>.php — then filters that account out of the Users screen and out of the role counts above it. Must-use plugins do not appear in your Plugins list and cannot be deactivated from the dashboard. You have to look at the files.

3. A magic login URL

A URL in the form /wp-login.php?_wplogin=<token>, backed by another dropped file, logs whoever holds the token straight in as your site’s oldest existing administrator. That is usually the account you created when you installed WordPress. No password involved. Changing your password does not invalidate it, because the token is not your password.

4. An unauthenticated file manager

The malicious plugin ships a file manager with no authentication check at all. Anyone who knows the URL can read, write, upload and delete files on your hosting account. This is the one that turns a compromised blog into a platform for whatever the attacker wants to do next.

Patchstack’s conclusion is blunt: removing the vulnerable plugin, or even the malicious one, closes none of the last three. Each needs separate cleanup.

The five-minute check

Do these in order. You do not need to be technical for the first three.

1. Check your plugin versions. Plugins → Installed Plugins. If Ninja Forms is below 3.15.4, or WPC Product Bundles is below 8.6.7, update now, before you do anything else.
2. Read your Users list. Users → All Users, then click the “Administrator” filter. Count them. If there is an account you do not recognize, you have found problem one.
3. Compare the count to the role tally. The number next to “Administrator” at the top of the Users screen is generated separately from the list below it. On a clean site those two numbers agree. If the tally says three administrators and you can only see two rows, something is filtering the list.
4. Look in the mu-plugins folder. Through your host’s file manager or SFTP, open wp-content/mu-plugins/. Most blogs have nothing in there, or one file their host put there deliberately. A file with a name like class-wp-query- followed by eight random characters does not belong.
5. Check for unexpected files in the plugins folder. Anything in wp-content/plugins/ that does not correspond to a plugin you installed is worth a hard look.

If steps 1 through 3 come back clean and you have been running current plugin versions since late September, you are almost certainly fine. The exploitation window began in early October against unpatched sites.

If you find something

Treat the site as compromised rather than as having one bad user account. In practice that means: restore from a backup taken before October 1, 2026 if you have one; if you do not, change every administrator password, force a logout of all sessions, rotate your database password and your hosting control panel password, delete the unrecognized accounts and the dropped files, and regenerate your WordPress salts in wp-config.php so existing session cookies stop working.

Regenerating salts is the step people skip, and it is the one that kills the magic login token’s usefulness along with every other stolen session.

If that list reads as more than you want to do yourself, this is a legitimate reason to pay for a cleanup — or to be on a host that includes one. It is also an argument for the kind of hosting that takes backups you can actually roll back to, which we get into in our WordPress security guide for bloggers.

Who should NOT panic about this

We try not to run security posts that leave everybody frightened and nobody informed, so here is the honest scoping.

You are not exposed to this specific campaign if you do not run either plugin. Ninja Forms is popular but it is not universal — WPForms, Contact Form 7, Fluent Forms, Gravity Forms and the Gutenberg form block are all unaffected by these two CVEs. WPC Product Bundles only matters if you run WooCommerce, which most beginner bloggers do not.

You are also in good shape if automatic plugin updates are switched on and have been running. The fixes landed on September 21 and shortly after. Auto-updates would have applied them well before the first exploitation on October 4.

And the honest tradeoff on auto-updates, since we are here: they occasionally break a site when a plugin ships a bad release. That risk is real. It is also much smaller than the risk of running a known-vulnerable form plugin for two weeks. For a blog — as opposed to a store processing payments — we think auto-updates on plugins are the right default, with daily backups as the safety net. For a WooCommerce store, staged updates are worth the extra effort.

What this says about your hosting

Hosting does not patch your plugins for you, but it changes how survivable a bad week is. The three things that matter here are backup retention you can actually restore from, malware scanning that looks at files rather than just pages, and support that will do a cleanup instead of pointing you at a paid partner.

Prices checked October 9, 2026. Note the renewal column — it is the number that actually governs what you pay from year two onward, and it is the reason we keep a running post on hosting renewal prices.

If you are starting fresh and want the cheapest plan that still takes backups seriously, Hostinger’s Premium plan is the one we point beginners at. If you would rather pay more and never touch a restore process, SiteGround’s StartUp plan has the most forgiving one-click rollback on shared hosting.

Frequently asked questions

Is Ninja Forms safe to use now?

Yes, on version 3.15.4 or later. The vulnerability is patched, the fix was credited to an outside researcher in the public changelog, and the plugin has shipped a further release since. There is no reason to migrate away from Ninja Forms over this incident alone.

How do I know if my blog was hacked?

Check whether the administrator count at the top of your Users screen matches the number of administrator rows you can see, and look for a file in wp-content/mu-plugins/ whose name starts with class-wp-query- followed by random characters. A mismatch or an unexpected file there is the clearest signal in this campaign.

Does changing my password fix a hidden admin account?

No. The hidden account has its own password, and the magic login URL does not use a password at all. You need to delete the account, remove the dropped files, and regenerate your WordPress salts so existing sessions are invalidated.

Will a security plugin have caught this?

Partly. A file-integrity scanner should flag the unexpected mu-plugin and the unauthenticated file manager. A plugin that only scans pages for malware signatures may not, because nothing visible on the front end changes. This is a good argument for the file-scanning kind, which we cover in our roundup of essential WordPress plugins for bloggers.

Should I turn on automatic plugin updates?

For a blog, yes, paired with daily backups. The two-week gap between the patch and the first exploitation in this campaign is exactly the window auto-updates are designed to close. For a store taking payments, test updates on staging instead.

Is this related to the September plugin security incidents?

It is a separate campaign with separate CVEs, but it follows the same pattern we wrote about in September’s WordPress plugin security roundup: disclosure, a patch, then a surge of exploitation against the sites that did not apply it.

The bottom line

Update Ninja Forms to 3.15.4 or later and WPC Product Bundles to 8.6.7 or later today. Then spend two minutes comparing your administrator count to your administrator rows, and one minute looking inside wp-content/mu-plugins/. If both look right, you are done.

If they do not, the important thing to understand is that deleting plugins is not cleanup. This campaign builds three doors that survive plugin removal, and the only reliable answers are a pre-October backup or a methodical pass through accounts, files and salts.

The broader lesson is unglamorous and keeps being true: the sites that get hit are not the ones running exotic software. They are the ones running popular software two weeks behind. Turn on auto-updates, keep backups you have actually tested restoring, and most of this category of news stops being about you. If your current host makes either of those hard, our guide to the best web hosting for bloggers is the place to start.

Sources

• Patchstack — Four ways back in: the WordPress XSS campaign that hides its own admin account
• WordPress.org — Ninja Forms changelog (3.15.4, September 21, 2026)
• WordPress.org — WPC Product Bundles for WooCommerce changelog (8.6.7)
• Security Online — Hackers exploit Ninja Forms and WPC Product Bundles XSS flaws to plant hidden WordPress admins
• webhosting.today — Attackers target Ninja Forms and a WooCommerce plugin to hide a WordPress admin (October 8, 2026)