WordPress Plugins to Patch This Week
By WP Vanguard Team
This is WP Vanguard's living patch list. It covers the WordPress plugin and theme flaws worth acting on right now, and we rebuild it every week at this same address instead of publishing a new post each time. Bookmark it once. This edition covers October 12 to October 16, 2026.
We order it the same way every week. Flaws attackers are already exploiting come first. Next are bugs that need no login at all, or that sit in plugins with huge install counts, because those are the easiest for an attacker to find and the most sites they can hit. Anything still waiting on a vendor fix comes last. For the full, always-current list of every disclosure we track, see /vulnerabilities.
We logged 139 critical or high-severity disclosures in these five days, across 97 plugins and 19 themes. 119 of them need no login, and 18 score 9.0 or higher. File upload and PHP object injection lead the list: LearnPress, Sunshine Photo Cart and Affiliates all have unauthenticated object injection, and a batch of 19 themes shares the same bug with no fix. Bricksforge is the one under attack.
Under Attack Right Now
These are flaws with confirmed exploitation in the last 30 days. If you run either of these, patch today and check for signs of compromise, not just the version number.
2
products are under active attack this week, and both have a fix
Bricksforge and WordPress core, exploitation confirmed in the last 30 days.
| Software | What's happening | Fixed in | Our write-up |
|---|---|---|---|
| Bricksforge (premium, not on wordpress.org) | CVE-2026-85097 lets anyone with no login upload a file and have the server run it as PHP. The Hacker News reported attacks against sites on 3.1.8.9 and earlier, and Patchstack scores it CVSS 10.0. Our database mirrors the Wordfence feed and records 9.8. | 3.1.8.10 | Read the writeup |
| WordPress core (4.7 through 7.1.1) | CVE-2026-87902 is a path traversal in how core picks a page template. A public proof-of-concept has been out since release day. The Hacker News reported attacks on September 24, and CISA added it to its Known Exploited Vulnerabilities catalog on September 25. | 7.1.2 (or 7.0.6, 6.9.9, 6.8.10 on older branches) | Read the writeup |
WooCommerce Wholesale Lead Capture, UpdraftPlus and miniOrange SAML SSO were on last week's table. Their exploitation reports are now more than 30 days old, so they've moved off it, but unpatched sites are still exposed. You need Wholesale Lead Capture 2.0.3.2, UpdraftPlus 1.26.5 (free) or 2.26.5 (premium), and miniOrange SAML SSO 5.4.5. Our writeups cover the Wholesale Lead Capture upload flaw, the UpdraftPlus auth bypass and the miniOrange SAML bypass.
Key finding
Update Bricksforge to 3.1.8.10 and WordPress core to 7.1.2 today. Updating doesn't remove anything an attacker already planted, so check for new PHP files and unknown admin users too.
Update WordPress Core
If your site is on core 7.1.1 or earlier, update to 7.1.2 now. WordPress.org backported the fix to every branch still receiving security fixes, so if you're pinned to an older line, the fixed releases are 7.0.6, 6.9.9 and 6.8.10.
There's no admin-panel setting that tells you whether you're exposed, because the bug depends on how themes resolve templates. Treat any unpatched site as vulnerable. Check Dashboard, then Updates, and confirm the version number rather than assuming auto-updates ran. Our full breakdown of CVE-2026-87902 covers what the bug does and how to confirm you're patched.
New This Week: Patch These First
Everything below needs no login, or sits in a plugin with a very large install base, and every row already has a fix. Update these before anything else on your list. Where the current release is newer than the fixed one, update to the current release.
Critical, no login needed
| Plugin | What an attacker can do | Affected | Fixed in | Installs |
|---|---|---|---|---|
| Click to Chat | Run arbitrary shortcodes through the {url} placeholder |
<= 4.44 | 4.45 | 600,000 |
| LatePoint | Bypass login by racing the one-time-code attempt counter | <= 5.7.4 | 5.7.5 | 100,000 |
| LearnPress | Inject PHP objects through the checkout-email parameter. See our object injection research. |
<= 4.4.10 | 4.4.11 | 70,000 |
| 10Web Booster | Upload arbitrary files through the page_id parameter |
<= 2.34.10 | 2.34.11 | 60,000 |
| Theme My Login | Escalate privileges through the user_pass1 POST parameter |
<= 7.2.1 | 7.2.2 | 50,000 |
| My Calendar | Escalate privileges by injecting a shortcode into the above attribute |
<= 3.8.7 | 3.8.8 (current) | 20,000 |
| MailOptin | Escalate privileges through form_custom_field_mappings |
<= 1.2.78.6 | 1.2.78.7 | 10,000 |
| Mang Board | Upload arbitrary files through the image_path parameter |
<= 2.4.4 | 2.4.5 | 8,000 |
| Sunshine Photo Cart | Inject PHP objects through the key parameter |
<= 3.7.4 | 3.7.5 | 1,000 |
| Abandoned Cart Pro for WooCommerce | Run SQL injection and bypass authentication through forged recovery links (three CVEs) | <= 10.8.0 | 10.8.1 | Premium |
LatePoint has three entries in five days, all fixed by 5.7.5: an account takeover in 5.7.2, a booking data leak in 5.7.3 and this OTP race in 5.7.4. Our booking plugin analysis covers why scheduling plugins keep landing here.
High severity, large install base or no login
| Plugin | What an attacker can do | Login needed? | Affected | Fixed in | Installs |
|---|---|---|---|---|---|
| Kirki | Read data through an object reference in the context parameter |
None | <= 6.3.2 | 6.4.0 | 500,000 |
| Modula Image Gallery | Read gallery settings exposed on a REST field | None | <= 3.0.11 | 3.0.12 | 100,000 |
| Profile Builder | Escalate privileges through the role parameter on the register form |
None | <= 4.0.3 | 4.0.4 | 40,000 |
| Form Maker by 10Web | Read or change data in the database through SQL injection in inputs |
None | <= 1.15.48 | 1.15.49 | 30,000 |
| FunnelKit | Read order details by guessing an order ID | None | <= 3.16.0.6 | 3.17.0 | 30,000 |
| Bit Integrations | Take over an account by replaying a log entry | None | <= 2.10.6 | 2.10.7 | 20,000 |
| Klarna for WooCommerce | Read order details through the order-pay endpoint |
None | <= 4.13.3 | 4.13.4 | 20,000 |
| ShopMagic | Include local files through the billing.first_name parameter |
None | <= 4.9.0 | 4.9.1 | 10,000 |
| Link Library | Read or change data in the database through SQL injection in link_url |
None | <= 7.9.2 | 7.9.3 | 10,000 |
| Customer Email Verification | Escalate privileges through the alg_wc_ev_verify_email parameter |
None | <= 3.3.0 | 3.3.1 | 8,000 |
| miniOrange OTP Verification | Bypass authentication through the delayed-OTP grace state | None | <= 5.5.8 | 5.6.0 | 5,000 |
| BP Profile Search | Include local files through a cookie value, which can lead to code execution | None | <= 5.9 | 6.0 | 5,000 |
PhastPress (10,000 installs) belongs here too: CVE-2026-3712 is an unauthenticated server-side request forgery through the src parameter in 3.10 and earlier. The fix is 3.11, and the current release, 3.12, dates from August 13, so the patch was out two months before the advisory. If a site still runs 3.10, the update has been waiting a long time.
Unauthenticated stored XSS in popular plugins
Another 53 unauthenticated stored XSS bugs landed in these five days. These are the ones in plugins with 40,000 or more installs. Each lets a visitor with no account plant a script that runs in an administrator's browser later. Nine of these plugins take the payload through a comment, a comment author link or a comment field, which is why a site with open comments is the easiest target. We broke down why this class keeps coming back in our writeup on unauthenticated stored XSS across WordPress plugins.
| Plugin | Affected | Fixed in | Installs |
|---|---|---|---|
| Complianz | <= 7.5.5 | 7.5.6 | 1,000,000 |
| TranslatePress | <= 3.3.7 | 3.3.8 | 400,000 |
| WPConsent | <= 1.1.9 | 1.2.0 | 200,000 |
| Hide My WP Ghost | <= 7.0.12 | 7.0.13 | 100,000 |
| SiteOrigin CSS | <= 1.6.7 | 1.6.8 | 100,000 |
| Schema & Structured Data for WP | <= 1.67 | 1.68 | 100,000 |
| SureCart | <= 4.9.4 | 4.9.5 | 80,000 |
| Colibri Page Builder | <= 1.0.390 | 1.0.392 | 80,000 |
| Ultra Addons for Contact Form 7 | <= 3.5.54 | 3.5.55 | 60,000 |
| Simply Schedule Appointments | <= 1.6.12.35 | 1.6.12.37 | 50,000 |
| Feedzy RSS Feeds | <= 5.2.11 | 5.2.12 | 40,000 |
| Profile Builder | <= 4.0.3 | 4.0.4 | 40,000 |
Also Fixed This Week
Everything here needs a login of some kind. These are still worth patching, just not before the lists above.
| Plugin | Flaw | Login needed? | Fixed in | CVSS |
|---|---|---|---|---|
| Backuply (600,000 installs) | Second-order SQL injection during a restore, leading to privilege escalation | Subscriber+ | 1.5.9 | 8.0 |
| Search Regex (100,000 installs) | Run code on the server by corrupting a serialized user meta string | Subscriber+ | 3.5.1 | 8.0 |
| WooCommerce Checkout Manager (80,000 installs) | Delete arbitrary media files | Subscriber+ | 7.9.7 | 8.1 |
| SureCart (80,000 installs) | PHP object injection. See our object injection research. | Custom role+ | 4.9.4 | 7.5 |
| User Registration & Membership (50,000 installs) | Run arbitrary shortcodes through the Referer header | Subscriber+ | 5.3.0 | 8.1 |
| InstaWP Connect (40,000 installs) | Escalate privileges and expose an API key | Subscriber+ | 0.1.4.2 | 7.5 |
| YaySMTP (10,000 installs) | Upload arbitrary files through an attachment filename | Subscriber+ | 2.7.8 | 8.8 |
| FV Flowplayer (10,000 installs) | Upload arbitrary files through the video_url parameter |
Subscriber+ | 7.5.55.7212 | 8.8 |
| LifterLMS (10,000 installs) | Include local files through checkout shortcode attributes | Contributor+ | 10.3.2 | 7.5 |
| Nexter Extension (10,000 installs) | Escalate privileges through the reset-view parameter |
Subscriber+ | 4.7.12 | 7.5 |
| Groundhogg (2,000 installs) | Delete arbitrary files through CSV import field mapping | Sales Representative+ | 4.9.4 | 8.1 |
| PilotPress (900 installs) | Take over an account through the username parameter |
Subscriber+ | 2.0.44 | 8.8 |
| Email Customizer for WooCommerce Pro (premium) | Run code on the server through the template parameter |
Subscriber+ | 3.9.6 | 8.8 |
Backuply's 600,000 installs make it the largest plugin in this table, and a Subscriber account is all it takes on a site with open registration. Search Regex shipped 3.5.1 on October 6, nine days before the advisory, so auto-updating sites were covered already. We looked at all 15 subscriber-level bugs from this week, and what open registration exposes, in this week's subscriber-level vulnerability report.
No Fix Available: Remove or Replace
A plugin with no fixed version and a closed listing won't get a security update, no matter how long you wait. Removing or replacing it is the only safe option. Every plugin below is closed on wordpress.org and has an open flaw with no fixed version.
| Plugin | Flaw | Login needed? | CVSS | Status |
|---|---|---|---|---|
| Snazzy Social Media Feed | Upload arbitrary files | None | 9.8 | Closed on wordpress.org October 12 |
| JTL-Connector for WooCommerce | Upload arbitrary files and SQL injection | None | 9.8 | Closed on wordpress.org October 7 |
| AGE-GATE | Run code on the server through PHP code injection | None | 9.8 | Closed October 6, temporarily and pending review |
| BuddyPress XProfile Image Field | Delete arbitrary files | None | 9.1 | Closed on wordpress.org October 5 |
| Document Gallery | Stored XSS | None | 7.2 | Closed on wordpress.org October 5 |
| AnyComment | Stored XSS | None | 7.2 | Closed on wordpress.org October 5 |
| Contact Form DB for Enfold | Stored XSS | None | 7.2 | Closed on wordpress.org October 5 |
| NewStatPress | Stored XSS (two entries) | None | 7.2 | Closed on wordpress.org October 2 |
| Cryptocurrency Donation Box | Stored XSS | None | 7.2 | Closed on wordpress.org October 8 |
| Verified Reviews (Avis Verifies) | Stored XSS | None | 7.2 | Closed on wordpress.org October 8 |
| Smart Forms | Stored XSS | None | 7.2 | Closed on wordpress.org October 8 |
| Auction Nudge | Stored XSS | None | 7.2 | Closed on wordpress.org October 9 |
Nineteen themes got the same unauthenticated PHP object injection entry on October 12 (CVSS 8.1), and none has a fixed version: Orpheus, Mission, Avventure, Gamezone, Le Truffe, Marcell, Filmax, Edge Decor, Good Homes, Muzicon, Coinpress, Gamic, Legal Stone, Bonbon, Motorix, EmojiNation, Meals & Wheels, Gunslinger and Nuts. If one is active on a site you manage, switch themes. The full list of theme entries is on /vulnerabilities.
Gmedia Photo Gallery (7,000 installs) has an unauthenticated SQL injection, CVE-2026-96661, for 1.25.1 and earlier. The advisory records no fixed version, but 1.25.2 shipped on October 14. We couldn't confirm that it closes the bug, so update to 1.25.2 and treat the site as exposed until the vendor says otherwise.
Last week's no-fix entries aren't repeated here. They stay on the hub until the vendor ships a fix or the listing disappears.
How to Check Your Sites Against This List
Run this on every site you manage to see what's actually installed and active:
wp plugin list --fields=name,status,version
Match the versions against the tables above. There are a couple of things this command won't tell you.
A premium plugin with an expired license won't show an update notice in wp-admin even when a fix exists, so check our guide on premium plugin licenses and security updates if any plugin on this list is one you paid for. That matters this week because Bricksforge, Abandoned Cart Pro, Email Customizer for WooCommerce Pro and User Registration PRO are all not listed on wordpress.org.
If a plugin here is closed on wordpress.org, our abandoned and closed plugin guide covers how to spot that before it becomes a problem. For a repeatable process across every site you manage, see how to check WordPress plugins for known vulnerabilities.
If you suspect a site was already hit before you patched, don't stop at updating. Walk through the signs your WordPress site has been hacked and, if anything matches, follow our WordPress malware removal guide before you consider the site clean.
Run a Scan
Run a scan on your site to check your installed plugin versions against our vulnerability database.
References
- Wordfence Intelligence
- CISA Known Exploited Vulnerabilities catalog
- The Hacker News: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw
- The Hacker News: attackers exploit WordPress CVE-2026-87902
- Patchstack: WordPress 7.1.2 Security Release, Unauthenticated LFI to RCE
- Patchstack: WooCommerce Wholesale Lead Capture privilege escalation
- Wordfence: attackers exploiting WooCommerce Wholesale Lead Capture
- SecurityOnline: UpdraftPlus CVE-2026-10795 exploit
- Patchstack: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
- Wordfence: attackers exploiting Super Forms
- Wordfence: attackers exploiting Elementor Pro
- WordPress releases
Related reading
Check Your WordPress Site Security
Free scan, no login required. Find vulnerabilities before attackers do.
Scan Your Site FreeGet weekly WordPress security tips
Vulnerability alerts, plugin updates, and security guides. No spam. Unsubscribe any time.