Hidden admin accounts: what the Ninja Forms attack teaches every WordPress owner

In early October 2026, security researchers reported attackers exploiting two popular WordPress plugins to take over websites, and doing it in a way designed to stay hidden. If you run WordPress, the details are worth five minutes of your time.

What happened

The plugins were Ninja Forms, a contact form plugin used on more than 500,000 sites, and WPC Product Bundles for WooCommerce, used on more than 30,000. Both had “stored cross-site scripting” flaws: an attacker could hide malicious code inside a form submission or an order.

Nothing happened until an administrator opened that submission or order in the WordPress dashboard. At that point, the hidden code ran with the administrator’s permissions and quietly:

• installed a fake plugin made to look legitimate
• created an administrator account that doesn’t appear on the normal Users screen
• set up several other ways back in, including a special login link
• backdated its files so they wouldn’t show up as recently changed

Why this one matters

Fixes for both plugins had been released in late September, before the attacks began. Sites that updated promptly were protected. Sites that didn’t were exposed to an attack that needed only an administrator to do their normal job: read a form submission.

It’s a pattern that repeats: most hacked WordPress sites aren’t victims of clever, unknown attacks. They’re running a plugin with a known, already-fixed flaw.

If you use either plugin

1. Update now. Ninja Forms to 3.15.4 or later, and WPC Product Bundles to 8.6.7 or later. Ideally update both to their latest versions.
2. Don’t assume deleting the plugin fixes things. If the attack already ran, the backdoors stay behind.
3. Look for a plugin you didn’t install, particularly one called “WP Smart Thumbnails”.
4. Change administrator passwords and, if you’re comfortable doing so, WordPress’s security keys (salts).
5. Ask for help if anything looks wrong. Hidden accounts are, by design, hard to spot from the dashboard.

The habits that prevent it

• Turn on automatic updates for plugins you trust, or check for updates at least weekly.
• Delete plugins you don’t use. Every plugin is code someone could attack.
• Give admin access only to people who need it.

Our WordPress security checklist covers the rest, and what to do if your site is compromised walks through recovery.