# WordPress plugin attacks install hidden administrator accounts and backdoors

_Published Tuesday, October 6, 2026 at 8:08 PM EDT · Security · Latest · Tier 2 — Notable_

![WordPress plugin attacks install hidden administrator accounts and backdoors — Primary](https://www.bleepstatic.com/content/hl-images/2026/04/07/NinjaForms.jpg)

Attackers are exploiting flaws in Ninja Forms and WPC Product Bundles for WooCommerce to install backdoors and create administrator accounts, BleepingComputer reported. Patchstack says exploitation is currently limited. The affected versions are Ninja Forms 3.15.3 and older and WPC Product Bundles 8.6.6 and older.

Malicious JavaScript placed in form submissions or order data executes when a logged-in administrator views it. The script uses that session to install a malicious plugin and establish several access routes, including a hidden administrator account. Patchstack recommends upgrading to Ninja Forms 3.15.4 or WPC Product Bundles 8.6.7 or later. Updating blocks further exploitation but does not remove existing infections.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/)

---
Canonical: https://techandbusiness.org/newswire/Sz2bPgltxq3L4XTb6T9fNX
Published: 2026-10-07T00:08:26.295Z
Story chronology: 2026-10-06T21:00:27.000Z
Retrieved: 2026-10-07T02:22:50.509Z
Publisher: Tech & Business (techandbusiness.org)