Let's build a website that works as hard as you do.
Get a fast, SEO-ready WordPress website built around your business, not a template.
Imagine opening WordPress, going to Users, and seeing exactly the administrators you expect. Now imagine there is one more, with full control of your site, that the screen has been told not to show you. That is what a WordPress attack campaign reported on 6 October 2026 does. On the same day, WordPress released 7.1.3, a security update that fixes the same kind of weakness in WordPress itself. Here is what both mean for a business website, and what we found when we checked the nine WordPress sites we look after.
What happened
WordPress 7.1.3. WordPress.org says the release “features 7 security fixes and 4 bug fixes” and that “Because this is a security release, it is recommended that you update your sites immediately.”[1] The fixes include a stored cross-site scripting (XSS) flaw on the Comments administration page, “exploitable via pending comments”, and the “Unauthenticated disclosure of comments on private & unpublished posts”. Sites that allow automatic background updates get it on their own.
Patchstack’s analysis of the release puts it in proportion.[3] Only two of the seven fixes start with an anonymous visitor, and one of those also needs a moderator to click a link. Three need a Contributor or Author account, one needs an administrator to run an export, and the last only matters if a plugin passes bad data to WordPress. Its advice: “Update as soon as you can, but this isn’t a drop-everything emergency.” One fix needs a follow-up. Imgur embeds could carry a script, and Patchstack notes the update “does not remove any existing, cached oEmbed content”, so a bad embed already on a page keeps showing until that stored copy is cleared.
Behind the release is a flood of reports. WordPress’s bug bounty page on HackerOne lists 2,004 reports received in the past 90 days, and between $90,000 and $95,000 in bounties paid over the same period.[4] It is the third WordPress security release in under three weeks, after 7.1.1 and 7.1.2 in September.[3]
The hidden-administrator campaign. Security firm Patchstack published its analysis on 6 October.[2] Attackers are using stored XSS flaws in two plugins, WPC Product Bundles for WooCommerce (through version 8.6.6) and Ninja Forms (through version 3.15.3), to plant a script. It does nothing until a logged-in administrator opens the order or form submission that holds it. Then, using that administrator’s own session, it installs a fake plugin called “WP Smart Thumbnails”, creates new administrators and hides one of them from the Users screen. In Patchstack’s words: “It is a fully privileged administrator the site owner cannot see.”
It also sets up a secret login link that signs the holder in as the site’s oldest administrator, and an unauthenticated file manager. Patchstack counts four ways back in, and warns: “Removing the vulnerable plugin, or even the malicious one, closes none of the last three.” The files it drops are backdated to look older than WordPress itself, so a search for recently changed files misses them.
Our view
Both stories are about the same kind of attack: something an outsider can type into your site, which waits until you, the administrator, look at it. A pending comment, an online order, a contact-form entry. You don’t have to click anything unusual; doing your normal job is enough. That is why “I never approve strange comments” is not a defence, and why updates matter even on quiet sites.
The hidden-account trick is the part business owners should remember. The WordPress dashboard is not a reliable place to check who has access once a site has been compromised, because the attacker controls what it shows. A real check reads the database directly. For a small business that usually means asking your developer or host, which is fine, as long as someone actually does it.
The bounty numbers matter for a different reason. When thousands of reports arrive every quarter, security releases stop being rare events and become routine: three in under three weeks this time. That is good news, because flaws are being found and fixed, but only for sites that actually take the updates. A site left alone for a few months now falls behind faster than it used to.
What we checked, 7 October 2026
We ran a read-only check on the nine WordPress sites we look after, including this one, using the indicators Patchstack published. It changed nothing on any site.
| What we looked for | Result |
|---|---|
| Ninja Forms or WPC Product Bundles installed | On none of the nine |
| The fake “WP Smart Thumbnails” plugin | Not found |
| The hidden must-use plugin files and the campaign’s database settings | Not found |
| The attacker’s script domain in posts, orders and site settings | Not found |
| Administrators in the database compared with what WordPress shows | The counts matched on all nine |
| WordPress 7.1.3 installed | Seven of nine within about seven hours of release; all nine later the same day, after we updated the other two |
| Stored Imgur embeds, which the update doesn’t clear | None on any of the nine |
| Contributor or Author accounts, the roles several of the fixes depend on | None on any of the nine; everyone who can edit content is an administrator or editor |
The last row is the useful lesson. Most sites had the security release within hours, but not all of them: hosting settings and older WordPress versions can hold an update back. Checking that an update actually arrived is part of looking after a site, and it is the part that tends to get skipped. It is one of the jobs in our WordPress care plans.
What not to do
- Don’t trust the Users screen alone. If a site may have been compromised, the dashboard can be made to hide accounts.
- Don’t stop at deleting the bad plugin. In this campaign the hidden account and the secret login survive it.
- Don’t hunt by date. The dropped files are backdated. Patchstack’s advice: “Sort by content, not by date.”
- Don’t assume automatic updates ran. Check the version number.
- Don’t panic-patch at 2am either. Most of 7.1.3’s fixes need a logged-in account. Update promptly, with a backup first; a calm, checked update beats a rushed one.
Check it yourself
- WordPress version: in the dashboard, open Updates. You want 7.1.3. If your site is on an older branch, WordPress says the fixes are being backported and that “only the most recent version of WordPress is actively supported.”[1]
- The two plugins: on the Plugins screen, Ninja Forms should be 3.15.4 or later and WPC Product Bundles 8.6.7 or later.[2]
- Imgur embeds: if any page shows an embedded Imgur image or album, the update doesn’t clear the copy WordPress already stored. Ask your developer to clear the stored embeds and your page cache.[3]
- Who can write on your site: on the Users screen, look for Contributor and Author accounts you no longer need. Patchstack suggests auditing these roles, because several of the fixes are about what they can reach.[3]
- The fake plugin: look for “WP Smart Thumbnails” by “MediaPress Labs”. You didn’t install it, so it shouldn’t be there.
- Hidden administrators: ask your developer or host to list administrators straight from the database, using the query in Patchstack’s report, and compare it with the Users screen. Any difference is a red flag, as is an unfamiliar account named something like “support” or “updater”.
If something doesn’t match, treat the site as compromised: remove the accounts and files, then change every administrator password. Our earlier piece on a WordPress backdoor that rebuilds itself explains why cleaning up has to be thorough.
Frequently asked
Do I need to update to WordPress 7.1.3?
Yes. WordPress.org recommends updating immediately because it fixes seven security issues, including a stored XSS flaw on the Comments page. Many sites install it automatically, but check the version number in Dashboard, Updates to be sure.
Is WordPress 7.1.3 an emergency update?
Not an emergency, but don’t leave it. Patchstack found that most of the seven fixes need a logged-in account, and only two start with an anonymous visitor. Update as soon as you reasonably can, and if any page embeds Imgur content, clear the stored embeds afterwards.
I don’t use Ninja Forms or WPC Product Bundles. Am I safe from this campaign?
Those are the two entry points confirmed so far, but Patchstack expects more. The attack works through any stored XSS flaw that puts a script in front of an administrator, so keeping every plugin and WordPress itself up to date is the real protection.
How can an administrator account be hidden in WordPress?
In this campaign, a must-use plugin changes the user lists WordPress builds, so one account is filtered out of the Users screen and its role counts. The account still exists in the database and still has full access, which is why a database check finds it.
What should I do if I find a hidden administrator?
Treat the site as compromised. Remove the hidden and unknown accounts, the fake plugin and the dropped must-use files, delete the campaign’s database settings, then change all administrator passwords and the WordPress security keys. Patchstack’s report lists every item to remove.
Not sure who has access to your site?
Send us your website. We will check your WordPress version, your plugins and your administrator list against what the database actually holds, and reply in writing with anything that needs attention. Request a free written review, or see what goes into website maintenance in Malaysia.
References
- WordPress.org, “WordPress 7.1.3 Maintenance and Security Release”, 6 October 2026. Accessed 7 October 2026.
- Patchstack, “Four ways back in: the WordPress XSS campaign that hides its own admin account”, 6 October 2026. Accessed 7 October 2026.
- Patchstack, “WordPress 7.1.3 Security Release”, 6 October 2026. Accessed 7 October 2026.
- HackerOne, “WordPress bug bounty program”, program statistics. Accessed 7 October 2026.
- Total Web Solutions: read-only checks of nine WordPress sites we look after, 7 October 2026.
