An order comes in. You open it in WordPress. Nothing looks unusual, but a script hidden in that order has just used your logged-in admin session to install a backdoor.
That’s the attack hitting sites with WPC Product Bundles for WooCommerce since October 4, 2026. Attackers began using a separate Ninja Forms flaw on October 5. Patchstack reported the campaign on October 6, and BleepingComputer covered it too. Patchstack says exploitation is still limited, but if you use either plugin, don’t wait for a warning from a customer.
How a form entry or order becomes an admin problem
These are two unrelated plugins with two stored cross-site scripting flaws. An attacker doesn’t need an account to plant the payload. In Ninja Forms, they submit a normal form with malicious text in a textarea. In WPC Product Bundles, they send a crafted quantity value that gets stored in WooCommerce order data. The script runs later, when a logged-in admin opens the affected entry.
The script loads from https://imgcdn1.com/fz/x.js. It doesn’t steal cookies. Instead, it works inside your existing admin session, collects WordPress security tokens called nonces, and uses WordPress’s own plugin installer to add a fake plugin. That domain was registered on October 1, after both flaws were publicly disclosed on September 22.
The fake plugin calls itself WP Smart Thumbnails, version 1.2.4, by MediaPress Labs. It sits in wp-content/plugins/wp-smart-thumbnails/ and does nothing when WordPress loads it. Your storefront may look completly fine. That’s a terrible test of whether you’re safe.
Four ways the attacker gets back in
This isn’t just a stray plugin you can delete and forget. The payload sets up several routes back:
- A visible administrator. It creates an account through the normal WordPress user screen, using credentials supplied by the attacker’s server.
- A hidden administrator. Its username can look ordinary, such as
supportorbackup, and its email ends in@wordpress.org. A must-use plugin named likeclass-wp-query-<8 hex chars>.phphides it from the Users screen, the Administrator filter and user counts. - A secret login. Another must-use plugin,
class-wp-token-validate.php, accepts a URL shaped like/wp-login.php?_wplogin=<token>. It logs the attacker in as the oldest existing administrator – often the owner – using tokens stored infz_emer_login_tokens. - An open file manager. A direct request to
wp-smart-thumbnails.phpopens a file manager with no password. It can upload, edit and delete files. Its title includesMoon, tell me if I could.
Must-use plugins load on every request and can’t be deactivated from wp-admin. They don’t appear on the normal Plugins screen; you may see them under Must-Use. Deleting the fake plugin folder leaves those files behind. That’s how an apparently successful cleanup can turn into another incident; our piece on why WordPress sites get reinfected explains the wider pattern.
Step 1: update both plugins
Update Ninja Forms to the latest version, currently 3.15.5. The fix starts at 3.15.4; versions through 3.15.3 are affected. For WPC Product Bundles, update to the latest version, currently 8.7.4. The fix starts at 8.6.7; versions through 8.6.6 are affected.
Do that first so new poisoned entries can’t use these flaws. Then keep going. Updating removes none of the backdoors already planted, and Patchstack expects the same payload could arrive through other plugins with a stored script flaw.
Step 2: check whether it already happened
You’ll need hosting file access and, for the database checks, phpMyAdmin or help from whoever manages your site. Take your time. The WordPress dashboard alone won’t give you the full picture.
- Look for
wp-content/plugins/wp-smart-thumbnails/. Its known files includewp-smart-thumbnails.php,emer-run.php,readme.txtandincludes/class-thumb-cache.php. - Check
wp-content/mu-plugins/forclass-wp-query-*.phpandclass-wp-token-validate.php. Don’t trust file dates: the fake plugin files were backdated to July 2026, and the must-use files were backdated using an old file timestamp from the WordPress root. - Compare administrators shown in wp-admin with users and administrator roles in your database through phpMyAdmin. Check for unexpected
@wordpress.orgaddresses.wp user list --role=administratoris another check, but the hiding plugin may affect that output too, so prefer a direct database check. - Search your WordPress options for
fz_emer_done_v1andfz_emer_login_tokens. Check available server or security logs forimgcdn1.com, requests containing_wplogin, and direct hits onwp-smart-thumbnails.php. - Inspect recent Ninja Forms submissions and WooCommerce orders for script tags. Use the database, or update before opening submissions in the old editor – viewing a poisoned entry there can trigger the attack.
Don’t rely on a matching file hash, either. The attacker changes the obfuscation for each site. A malware scan can help find suspicious files, but it shouldn’t replace the checks above.
If you find it, clean the whole chain
First, make a backup copy of the files and database for evidence. Then remove wp-smart-thumbnails/ and both malicious must-use plugin files. Delete the two fz_emer_ options and remove the attacker-created admin accounts, including any hidden one you found in the database. Check each account carefully before deleting it.
Change the passwords for the oldest administrator and every other admin. Reset the WordPress salts in wp-config.php to log everyone out. Because the open file manager could write elsewhere, check for other dropped files and scan the site. Finally, remove the poisoned form submissions or order data so nobody triggers the script while investigating; keep the evidence copy first.
If you’re unsure which files or users belong, stop guessing and get hacked site cleanup help. Our guide to the first 24 hours after a WordPress hack can help you decide what to handle next.
One check to make today
Updated already? Open your hosting file manager and look in wp-content/mu-plugins/. If either of those named files is there, don’t treat the green “plugins updated” message as a clean bill of health.