Backdoors Outlast Patching
Patchstack’s 6 October report traced one payload to WPC Product Bundles through 8.6.6 (CVE-2026-93836) and Ninja Forms through 3.15.3 (CVE-2026-94504), exploited on 4 and 5 October respectively.
How the payload ran
Unauthenticated input stored script in WooCommerce order metadata via numeric-prefixed WPC quantities, or in plain-text Ninja textareas. Administrators opening the order or legacy submission triggered stored XSS.
The payload added a malicious plugin, visible and hidden administrators, an owner-login backdoor and an unauthenticated file manager using that administrator’s session.
Check updates and access
On 19 October, the official directories list Ninja Forms 3.15.6 and WPC Product Bundles 8.7.7. Ninja’s earlier 3.15.4 release hardened administrative submission escaping. WPC’s 8.6.7 recorded the vulnerability fix; 8.7.3 later sanitised and allow-listed stored bundle components.
Patching leaves installed persistence intact. Owners should preserve evidence before cleanup, inspect accounts, plugins (including mu-plugins) and files, then rotate credentials and authentication salts.
BlackTree’s earlier WordPress incident analysis supports that response method. It concerns a different plugin family and campaign, not a shared cause.
Evidence limits
The report gives limited telemetry, no victim count or attribution. A vulnerable site is not proof of compromise.
