WordPress plugin attacks install hidden administrator accounts and backdoors

Attackers are exploiting flaws in Ninja Forms and WPC Product Bundles for WooCommerce to install backdoors and create administrator accounts, BleepingComputer reported. Patchstack says exploitation is currently limited. The affected versions are Ninja Forms 3.15.3 and older and WPC Product Bundles 8.6.6 and older. Malicious JavaScript placed in form submissions or order data executes when a logged-in administrator views it. The script uses that session to install a malicious plugin and establish several access routes, including a hidden administrator account. Patchstack recommends upgrading to Ninja Forms 3.15.4 or WPC Product Bundles 8.6.7 or later. Updating blocks further exploitation but does not remove existing infections.