WordPress Plugins to Patch This Week
By WP Vanguard Team
This is WP Vanguard's living patch list. It covers the WordPress plugin and theme flaws worth acting on right now, and we rebuild it every week at this same address instead of publishing a new post each time. Bookmark it once. This edition covers October 8 to October 11, 2026.
We order it the same way every week. Flaws attackers are already exploiting come first. Next are bugs that need no login at all, or that sit in plugins with huge install counts, because those are the easiest for an attacker to find and the most sites they can hit. Anything still waiting on a vendor fix comes last. For the full, always-current list of every disclosure we track, see /vulnerabilities.
We logged 45 critical or high-severity disclosures in these four days, across 42 plugins. 37 of them need no login, and 7 score 9.0 or higher. Authentication and login bypass is the theme: WPCOM Member, Advanced IP Blocker, WPO365 and Advanced Form Integration all fixed a way around their own sign-in checks. WordPress core is also on CISA's list of actively exploited flaws.
Under Attack Right Now
These are flaws with confirmed exploitation in the last 30 days. If you run any of these, patch today and check for signs of compromise, not just the version number.
4
products are under active attack this week, and every one has a fix
WordPress core and three plugins, exploitation confirmed in the last 30 days.
| Software | What's happening | Fixed in | Our write-up |
|---|---|---|---|
| WordPress core (4.7 through 7.1.1) | CVE-2026-87902 is a path traversal in how core picks a page template. A public proof-of-concept has been out since release day. The Hacker News reported attacks on September 24, and CISA added it to its Known Exploited Vulnerabilities catalog on September 25. | 7.1.2 (or 7.0.6, 6.9.9, 6.8.10 on older branches) | Read the writeup |
| WooCommerce Wholesale Lead Capture | CVE-2026-27540 lets an attacker upload a PHP file with no login at all. CVE-2026-27542 lets them escalate privileges on top of that. Wordfence has blocked over 100,000 exploit attempts. | 2.0.3.2 | Read the writeup |
| UpdraftPlus | A broken decryption check turns a failed key exchange into a predictable all-zero key. That lets an attacker forge signed UpdraftCentral commands against sites with an active Migrator or UpdraftCentral key. | 1.26.5 (free), 2.26.5 (premium) | Read the writeup |
| miniOrange SAML SSO | A signature-verification gap lets an attacker log in as any user, including the admin, by forging a SAML response. | 5.4.5 | Read the writeup |
Super Forms and Elementor Pro were on last week's list. The exploitation reports are now more than 30 days old, so they've moved off this table, but unpatched sites are still exposed. Super Forms needs 6.3.317 or later, and Elementor Pro needs 4.2.2 or later. Our writeups cover the Super Forms upload flaw and the Elementor Pro upload flaw.
Key finding
Patch the four under attack today: core 7.1.2, Wholesale Lead Capture 2.0.3.2, UpdraftPlus 1.26.5 or 2.26.5 and miniOrange SAML SSO 5.4.5. Updating doesn't remove anything an attacker already planted, so check for signs of compromise too.
Update WordPress Core
If your site is on core 7.1.1 or earlier, update to 7.1.2 now. WordPress.org backported the fix to every branch still receiving security fixes, so if you're pinned to an older line, the fixed releases are 7.0.6, 6.9.9 and 6.8.10.
There's no admin-panel setting that tells you whether you're exposed, because the bug depends on how themes resolve templates. Treat any unpatched site as vulnerable. Check Dashboard, then Updates, and confirm the version number rather than assuming auto-updates ran. Our full breakdown of CVE-2026-87902 covers what the bug does and how to confirm you're patched.
New This Week: Patch These First
Everything below needs no login, or sits in a plugin with a very large install base, and every row already has a fix. Update these before anything else on your list. Where the current release is newer than the fixed one, update to the current release.
Critical, no login needed
| Plugin | What an attacker can do | Affected | Fixed in | Installs |
|---|---|---|---|---|
| Blocksy Companion | Escalate privileges through the role parameter |
<= 2.1.58 | 2.1.59 | 300,000 |
| PPOM | Delete arbitrary files through the ppom[fields] upload parameter |
<= 34.0.10 | 34.0.11 | 20,000 |
| Extensions For CF7 | Upload arbitrary files | <= 3.4.5 | 3.4.6 | 5,000 |
| Advanced IP Blocker | Bypass the two-factor login step | <= 8.13.13 | 8.13.14 | 2,000 |
| WPCOM Member | Bypass authentication through the social-login callback | <= 1.7.27 | 1.8.0 | 1,000 |
| Expivi 3D Product Configurator | Run code on the server through the xpv_image parameter |
<= 2.16.2 | 2.16.3 | 100 |
| Avada (Fusion) Builder | Trigger arbitrary WordPress actions through a dynamic-data token in form fields | <= 7.16.1 | 7.16.2 | Premium, ships with Avada |
High severity, large install base or no login
| Plugin | What an attacker can do | Login needed? | Affected | Fixed in | Installs |
|---|---|---|---|---|---|
| Cache Enabler | Delete files and directories through a path traversal | None | <= 1.8.16 | 1.8.17 | 100,000 |
| WPO365 Login | Bypass authentication by replaying an OIDC nonce | None | <= 44.1 | 45.0 | 10,000 |
| GeoDirectory | Include local files through the design_type parameter |
None | <= 2.8.187 | 2.8.188 | 10,000 |
| Advanced Form Integration | Change a user's password without verification, leading to account takeover | None | <= 2.9.0 | 2.10.0 | 9,000 |
| rtMedia | Read and delete limited files through a sideload parameter | None | <= 4.7.13 | 4.7.14 | 7,000 |
| Music Store | Read arbitrary files through the f parameter |
None | <= 1.4.7 | 1.4.8 | 200 |
| Divi Plus | Read arbitrary files through the svg_image parameter |
None | <= 2.4.0 | 2.4.1 | Premium |
Cache Enabler's fix (CVE-2026-19253) shipped on September 27 and the advisory followed on September 29, seven months after the previous release. If it's on a site you manage and hasn't updated, check it by hand, because a plugin that quiet is easy to miss.
Unauthenticated stored XSS in popular plugins
Another 20 unauthenticated stored XSS bugs landed in these four days. These are the ones in plugins with 40,000 or more installs. Each lets a visitor with no account plant a script that runs in an administrator's browser later. We broke down why this class keeps coming back in our writeup on unauthenticated stored XSS across WordPress plugins.
| Plugin | Affected | Fixed in | Installs |
|---|---|---|---|
| Presto Player | <= 4.5.1 | 4.5.2 | 100,000 |
| Rocket LazyLoad | <= 2.4.0 | 2.4.1 | 100,000 |
| 10Web Booster | <= 2.34.8 | 2.34.10 | 60,000 |
| Easy Digital Downloads | <= 3.6.9 | 3.6.9.1 | 40,000 |
| Quiz and Survey Master | <= 11.2.6 | 11.2.7 | 40,000 |
Also Fixed This Week
Everything here needs a login of some kind. These are still worth patching, just not before the lists above.
| Plugin | Flaw | Login needed? | Fixed in | CVSS |
|---|---|---|---|---|
| LifterLMS (10,000 installs) | PHP object injection through custom lesson data | Custom role+ | 10.3.0 | 8.8 |
| Bookly (60,000 installs) | PHP object injection through the value parameter |
Custom role+ | 28.3 | 7.2 |
| LatePoint (100,000 installs) | Escalate privileges through the default customer role setting. See our booking plugin analysis. | Custom role+ | 5.7.4 | 8.8 |
| Groundhogg (2,000 installs) | Escalate privileges through the user parameter |
Custom role+ | 4.9.1 | 8.8 |
| FooSales (700 installs) | Escalate privileges through the customer REST endpoint | Custom role+ | 1.43.1 | 8.8 |
| FV Player (1,000 installs) | Upload arbitrary files through the video source field | Subscriber+ | 8.1.8 | 8.8 |
| WP File Download (premium) | Delete or change files through the task parameter |
Subscriber+ | 6.3.10 | 8.1 |
Booking Activities, String Locator and MainWP Child fixed the same bug class this month. Our unserialize analysis covers what each one needs before it's dangerous.
No Fix Available: Remove or Replace
A plugin with no fixed version and a closed listing won't get a security update, no matter how long you wait. Removing or replacing it is the only safe option. Several backup and migration plugins and a block of themes are new to this list.
| Plugin | Flaw | Login needed? | CVSS | Status |
|---|---|---|---|---|
| Everest Backup (3,000 installs) | Run code on the server | None | 9.8 | No fixed version recorded. The latest release, 2.3.13, is from August 20. We couldn't confirm this one against a second source, so check the vendor before you act. |
| Tourfic Pro | Escalate privileges with no login | None | 9.8 | No fix published, premium |
| Simple File List | Delete arbitrary files | None | 9.1 | Closed on wordpress.org July 23 |
| Booknetic | Read or change data in the database through SQL injection | None | 7.5 | No fix published, premium |
| Radius Booking (400 installs) | Read or change data in the database through SQL injection | None | 7.5 | No fix published, latest 1.0.19 is from September 1 |
| SendPress Newsletters | Read or change data in the database through SQL injection | None | 7.5 | Closed on wordpress.org September 28 |
| GDPR Framework by Data443 (10,000 installs) | PHP object injection | None | 8.1 | No fix published, latest 2.5.0 is from August 17 |
| WP Duplicate (200 installs) | Upload arbitrary files | Subscriber+ | 8.8 | No fix published, latest 1.1.11 is from June 16 |
| Biolife, Boutique, KuteShop, Armania, TechOne and Werkstatt themes | Include local files, the same flaw in each | None | 8.1 | No fix published for any of the six |
| Request a Quote for WooCommerce | Upload a file that runs code on the server | None | 9.8 | No fix published, not listed on wordpress.org |
| Frontegg SAML SSO | Bypass authentication and log in as an administrator | None | 9.8 | Closed on wordpress.org September 4 |
| MemberHero | Escalate privileges with no login | None | 7.3 | Closed on wordpress.org September 30 |
SiteVault Backup (20 installs) also has an unauthenticated code execution entry for 1.5.18 and earlier. Its 1.5.19 release arrived October 9, but we couldn't tell from the code whether it fixes that bug, so treat it as unpatched until the vendor says otherwise.
Separately, Admin Menu Editor Pro 2.35 and 2.36 shipped with a backdoor rather than a vulnerability. If you installed either version, updating isn't enough. Our writeup on the Admin Menu Editor Pro backdoor covers what to look for.
How to Check Your Sites Against This List
Run this on every site you manage to see what's actually installed and active:
wp plugin list --fields=name,status,version
Match the versions against the tables above. There are a couple of things this command won't tell you.
A premium plugin with an expired license won't show an update notice in wp-admin even when a fix exists, so check our guide on premium plugin licenses and security updates if any plugin on this list is one you paid for. That matters this week because Bricksforge, Divi Membership, DevKit Pro, Super Forms and the Ninja Forms File Uploads add-on are all not listed on wordpress.org.
If a plugin here is closed on wordpress.org, our abandoned and closed plugin guide covers how to spot that before it becomes a problem. For a repeatable process across every site you manage, see how to check WordPress plugins for known vulnerabilities.
If you suspect a site was already hit before you patched, don't stop at updating. Walk through the signs your WordPress site has been hacked and, if anything matches, follow our WordPress malware removal guide before you consider the site clean.
Run a Scan
Run a scan on your site to check your installed plugin versions against our vulnerability database.
References
- Wordfence Intelligence
- CISA Known Exploited Vulnerabilities catalog
- The Hacker News: attackers exploit WordPress CVE-2026-87902
- Patchstack: WordPress 7.1.2 Security Release, Unauthenticated LFI to RCE
- Patchstack: WooCommerce Wholesale Lead Capture privilege escalation
- Wordfence: attackers exploiting WooCommerce Wholesale Lead Capture
- SecurityOnline: UpdraftPlus CVE-2026-10795 exploit
- Patchstack: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
- Wordfence: attackers exploiting Super Forms
- Wordfence: attackers exploiting Elementor Pro
- WordPress releases
Related reading
Check Your WordPress Site Security
Free scan, no login required. Find vulnerabilities before attackers do.
Scan Your Site FreeGet weekly WordPress security tips
Vulnerability alerts, plugin updates, and security guides. No spam. Unsubscribe any time.