The form plugin is being used in the wild to plant backdoors, and it is still necessary to check which places after the upgrade.
This form plugin has been exploited in the wild to implant a backdoor. After the upgrade, which parts need to be checked? This round of publicly reported stored XSS attacks targets form plugins for WordPress sites, affecting over 530,000 sites. The attack payload will also leave a hidden admin account. Installing the patch only closes the entry, but the sessions already inside, the extra accounts, and the damaged templates are still working. Therefore, after the upgrade, you need to check the following five places: 'accounts', 'files', 'content', 'entry', and 'backup'.
What has this in-the-wild exploitation modified?
Public threat research (October 6, 2026) states that two vulnerability IDs CVE-2026-94504 and CVE-2026-93836 have a CVSS score of 6.1, affecting Ninja Forms 3.15.3 and below, WPC Product Bundles 8.6.6 and below, and confirmed in-the-wild exploitation.It is a stored cross-site scripting (XSS): The content submitted to the form is stored as is, and then executed on the management backend page, so when the administrator browses the comments or form records, it becomes the execution environment of the attack script.
| Inspection items | Specific action | Anomaly detected after |
|---|---|---|
| Administrator account | Check all accounts and roles against the name list | Disable suspicious accounts and check login records |
| Plugin directory | Find non-self-installed files by name and modification time | Isolate copies first and then delete |
| Templates and main text | Check footer, header, and script at the end of the article | Restore after comparing with backup |
| Form entry | Enable robot verification and field restrictions | Keep evidence and tighten rules before |
| Backup | Confirm that the backup time is earlier than the intrusion signs | Reconstruct with a clean backup instead of cleaning on site |
Check accounts and permissions first after upgrading
The attacker's target is rarely to 'pop up a window', but to stay on the site. The first thing is to list the administrator accounts and check them one by one: who created them, when was the last login, and whether there are any extra entries. This report clearly mentions that the attack payload will create hidden administrator accounts, and it is not enough to just look at the first few lines of the list; you need to sort by role and creation time and treat all unfamiliar names as suspicious objects. After checking the accounts, change the passwords of all administrators again and confirm that the failure lock and access restrictions at the login entry are effective.
Where are the backdoors usually hidden?
Backdoors often appear with normal plugin names in the plugin directory, this round uses names like 'WP Smart Thumbnails' that look reasonable. The method of inspection is not to rely on visual recognition, but to compare: compare the file list with a clean backup or a newly installed similar site; focus on the files that have been added or recently modified in the plugin directory and theme directory; then check the scripts written in the templates and main text, attack scripts are often hung at the footer, header, or end of articles, and may also be inserted into the form confirmation page. The database content should also be checked, as it is common to modify historical articles in bulk.
The principle of cleaning is 'prefer to rebuild'. It is difficult to confirm that there are no second residues after a file has been modified, and it is more reliable to restore the site with a clean backup before the signs of intrusion than to repeatedly delete in the poisoned environment. After the restoration, change the credentials, and reversing the order will put the deleted credentials back.
How to reduce the recurrence probability of the form entry
The form is an attack surface, cannot rely solely on patches. The effective combination is three things: First is robot verification, integrating the form and comments into the captcha mechanism, AnQiCMS forms can be integrated with reCAPTCHA to prevent robot batch submission; Second is field constraints and length limits, reducing the script space that can be stored as is; Third is to tighten the escaping and permission on the background browsing side, when administrators view submission records, they should not execute the submitted content. This round of entry is in the plugin, but the logic applies to all forms that can receive external input: comments, subscriptions, password recovery pages all need to be checked against the same standard.
Self-check of similar risks within the site
On the content side, there are two safety nets. Sensitive word filtering and content review can prevent the page content written after tampering from being published; keyword replacement can remove abnormal external links from the text; anti-crawling interference codes and JWT authentication, and defense against SQL injection and XSS attacks belong to the same level of daily protection, but cannot replace event response. The self-check list can be fixed: whether the version and plugins are the current supported versions, whether the forms and comments have robot verification, whether the administrator accounts are minimized, whether the backup can be restored by time points, and whether the tampered content has audit痕迹.
It is most effective to do two things after an event: fix the patch window as a scheduled task, and run the backup recovery drill quarterly. By the time the second invasion actually happens, it is these few hours that will save you.
Common questions
Do I need to change the credentials after installing the patch?Yes. The patch closes the entry, does not revoke the sessions and accounts already issued, and the credentials and accounts must be handled together.
How can you determine if the site has been exploited?Look for three signs: unknown entries in the admin account, files appear in the plugin or theme directory that were not installed, and unfamiliar scripts appear in the front-end page source code. If any of these are present, treat it as an intrusion.
Can I just delete the backdoor files?It is not recommended as the final processing. The file and database may be modified in many places, and backdoors may still remain after deletion; it is more stable to rebuild or migrate to a new environment with a clean backup.
Do you still need to report after cleaning?If the site has processed user personal information or payment-related information, it should evaluate the notification and obligation to inform according to internal and local requirements, and retain evidence copies.