GajShield Threat Advisory — "Four-Ways-Back-In" WordPress XSS Campaign (CVE-2026-94504 / CVE-2026-93836)

Severity: HIGH | Priority: P2

GajIPS signatures detect a multi-stage WordPress compromise campaign, named "Four-Ways-Back-In" by Patchstack, that exploits unauthenticated stored cross-site scripting vulnerabilities in two widely deployed plugins: Ninja Forms (CVE-2026-94504, affecting versions ≤3.15.3, installed on 500,000+ sites) and WPC Product Bundles for WooCommerce (CVE-2026-93836, affecting versions ≤8.6.6). An attacker submits a JavaScript payload through an unauthenticated form endpoint — the nf_ajax_submit AJAX handler in Ninja Forms or the woosb_ids quantity field in WPC Product Bundles — and the payload executes within the administrator's browser session the next time the admin views the stored submission. Once execution is achieved in the admin session, the implant at imgcdn1.com/fz/x.js is fetched and used to install a hidden administrator account, drop obfuscated must-use plugins that suppress the account from the WordPress users interface, and establish an unauthenticated file manager backdoor. 

If these rules trigger on your network, treat the alert as a confirmed compromise indicator for any site running the vulnerable plugin versions. Immediately isolate the affected WordPress installation from administrative access, rotate all WordPress administrator credentials and application secrets, and conduct a filesystem audit for the known malicious plugin slugs wp-smart-thumbnails, class-wp-query-*.php, and class-wp-token-validate.php in both wp-content/plugins/ and wp-content/mu-plugins/. Remove any hidden administrator accounts (those not visible in the standard Users screen) by querying the database directly (SELECT * FROM wp_usermeta WHERE meta_key='wp_capabilities' AND meta_value LIKE '%administrator%'). Search browser localStorage across admin workstations for the __xp_v9_ key prefix as evidence of prior implant execution. Update Ninja Forms to version 3.15.4 or later and WPC Product Bundles to version 8.6.7 or later before restoring public access.