WPManageNinja Hacked: Fluent Forms Pro and Ninja Tables Pro Tampered

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/6 · Initial Access via Supply Chain

Attackers compromised a forgotten legacy update server of WPManageNinja that was accidentally left online during the migration away from Easy Digital Downloads (EDD).

T1195.002 – Supply Chain Compromise: Compromise Software Supply Chain T1584 – Compromise Infrastructure
  • Old update server with active proxy-routing rules remained online after migration
  • Proxy partly forwarded update requests to the compromised server
  • Time window: 2026-07-31, 14:00–19:00 UTC (about 5 hours)
  • WPManageNinja founder admitted: 'This was our fault. That old server should have been switched off.'
PHASE 2/6 · Malicious Delivery

Trojanized plugin versions were delivered to security-conscious site operators through the official update channel.

T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1059.007 – Command and Scripting Interpreter
  • Affected: Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11
  • Malicious code hidden in class-license-sync.php and NinjaTableDataSync.php
  • Automatic updates also delivered the trojanized versions
  • 1,368 customers notified, ~295 accounts downloaded the trojanized version
PHASE 3/6 · Privilege Escalation / Backdoor Access

The malware established a passwordless administrator access allowing attackers to log directly into wp-admin.

T1136.001 – Create Account: Local Account T1078 – Valid Accounts
  • Set up a login_key for passwordless admin login
  • Each site received its own token and login_key
  • Researcher quote: 'The login_key is a login to wp-admin without a password.'
  • Potential full access to customer data, form submissions and user data
PHASE 4/6 · Command-and-Control Communication

The malicious code connected infected sites to an external attacker-controlled command server.

T1071.001 – Application Layer Protocol: Web Protocols T1041 – Exfiltration Over C2 Channel
  • C2 server at address apii.observer
  • Each infected site 'called home' with its own token
  • Attackers had a working admin door on every infected site
PHASE 5/6 · Defense Evasion

The malware disguised its traces in the database as harmless system entries.

T1027 – Obfuscated Files or Information T1564 – Hide Artifacts
  • Disguised as WordPress transients (e.g. _site_transient_update_meta)
  • Inconspicuous file names like class-license-sync.php
  • Hidden entries in the wp_options table / option_value column
PHASE 6/6 · Persistence

Via WP-Cron jobs the malware set up a self-healing mechanism, rendering mere file deletion useless.

T1053.005 – Scheduled Task/Job: Cron T1546 – Event Triggered Execution
  • Cron hooks: wp_update_check_schedule and wp_license_verify_schedule
  • Malware re-invoked itself twice daily
  • Simply deleting files triggers reinstallation of the malware
  • Cleanup requires salt rotation and resetting all admin passwords
Short & clear answers
Frequently asked questions about this incident
Am I affected by this incident?
You are potentially affected if you use Fluent Forms Pro or Ninja Tables Pro and your website ran an update on 31 July 2026 between 4:00 and 9:00 PM German time – whether manually or automatically. Specifically, this concerns the manipulated versions Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11. The free versions from the WordPress directory were not affected.
How can I check whether my website is infected?
Check the WordPress database (table wp_options) for the string 'apii.observer' or the cron hooks 'wp_update_check_schedule' and 'wp_license_verify_schedule'. Also review your administrator accounts for unknown entries and search the 'wp-content/uploads/' folder for unexpected PHP files. Additionally, look in the plugin directories for suspicious files such as 'class-license-sync.php' or 'NinjaTableDataSync.php'.
What exactly do I need to do now to remove the malware?
Completely delete the affected plugin (not just deactivate it) and install a clean version – Fluent Forms Pro 6.2.8 or newer, or Ninja Tables Pro 5.2.13 or newer. Then clean the database of the manipulated options and cron events, rotate the WordPress salts in wp-config.php, and reset all administrator passwords. A simple update is not enough, as the malware restores itself via cron jobs.
Is it enough to just update the plugin?
No, a simple update is not sufficient. The malware sets up a self-preservation mechanism via WP-Cron jobs that reinstalls itself twice a day. You must completely delete the plugin, clean the database, rotate the salts, and reset all admin passwords – only then is your website secure.
Do I have to report this incident to an authority under GDPR?
In most cases, yes. Because the malware established passwordless admin access, attackers potentially had full access to all customer, form, and user data, which constitutes a high risk. Under Art. 33 GDPR, such a data breach must be reported to the competent supervisory authority within 72 hours of becoming aware of it. Additionally, affected individuals may need to be informed under Art. 34 GDPR.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.