Published October 26, 2026. Covers our reporting from October 19 to 25, 2026; details may change.

This week brought an emergency PHP release, a backdoored Rank Math PRO build, and unauthenticated flaws in several widely installed plugins, led by LiteSpeed Cache. If you only do three things: confirm every site runs a fixed PHP release, check whether any site activated Rank Math PRO 3.0.123, and update LiteSpeed Cache, ACF Extended, PixelYourSite and Otter Blocks wherever you run them. The rest of this page ranks the week's issues and links to our full write-ups.

Patch first

These items allow attacks without a login, reach very large install bases, or arrived through a trusted update, so they come before routine maintenance.

PHP critical security release

On October 21 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. Both can lead to remote code execution without logging in, and the PHP project has a working exploit for mod_php that triggers before any application code runs. Every WordPress site is in scope. Check Tools > Site Health > Info > Server, and if your host has not applied the fix, ask when it will. Distribution packages may carry a different version number with the fix included.

Rank Math PRO 3.0.123 backdoor

Some Rank Math PRO 3.0.123 downloads between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained a backdoor that can recreate itself. If a site activated that build, treat it as compromised: restore from before the window or clean it, rotate every credential, then install 3.0.124. The free Rank Math plugin was not affected.

LiteSpeed Cache before 7.9.2

LiteSpeed Cache has 7,000,000+ active installations, and two of its three new CVEs are stored XSS issues an unauthenticated commenter can trigger. Update to 7.9.2 and review recently published comments. WPScan plans to display proof-of-concept details in November.

ACF Extended before 0.9.2.8

Four CVEs in the Forms module of Advanced Custom Fields: Extended and its PRO edition can let unauthenticated visitors take over accounts or run code on the server, on sites whose front-end forms are configured in specific ways. Update both editions to 0.9.2.8, then review forms, users and field definitions.

Other unauthenticated issues

  • PixelYourSite (400,000+ installs): stored XSS through a cookie on cached sites. Update to 11.4.3 (Pro 12.6.8), then purge every cache layer.
  • Otter Blocks (300,000+ installs): four CVEs, three usable without logging in. Update to 3.2.8.
  • WebP Express (300,000+ installs): stored XSS when Alter HTML is enabled. Update to 0.25.16.
  • CleanTalk Anti-Spam: stored XSS through user_email on sites with open registration, affecting versions through 6.89.1. Update to 6.90 or later.
  • Weglot: stored XSS on translated pages. Update to 6.4.3.
  • Prime Mover: PHP object injection through 2.2.1, scored 9.8 by Wordfence. A visitor plants a payload in a comment and it runs when an administrator later exports or restores. Update to 2.2.2 before your next export.
  • WP User Manager (10,000+ installs): versions 2.9.21 to 2.9.25 let someone registering get access the paid-registration settings should block. Update to 2.9.26 or later and review recent accounts and roles.
  • SureCart (80,000+ installs): private catalog data exposed to anonymous visitors before 4.9.5. Update to 4.9.5 or later.
  • Duplicator: attacker-stored content becomes dangerous when an administrator later runs a migration. Update past 1.5.17 (Pro past 4.6.10) before your next package.
  • From the October 23 roundup: Royal MCP before 1.5.7 (full site takeover through a preview token) and FluentCart before 2.2.0 (customer address exposure). Music Store through 1.4.7 allows file reads; 1.4.8 is now available, so update and rotate the secrets in wp-config.php.
  • From the October 24 roundup: asVereinbase before 1.1.8 (log in as any user), GTM Server Side by Stape before 2.1.48 (other customers' order data exposed) and GeoDirectory before 2.8.194 (seven CVEs, three unauthenticated).

Closed plugins with no fix

Front End Users (through 3.2.35, unauthenticated visitors can mark their own accounts approved and paid), MAS Videos and Advanced Twenty Seventeen were closed on WordPress.org on October 13, 2026 with no newer version. Remove or replace them.

Old flaws with exploitation evidence

Four long-fixed issues only received CVE IDs this week, and each record notes exploitation evidence observed by the Shadowserver Foundation: the Javo Spot theme before 3.0.0, Broadstreet Ad Widget before 2.12.0, NotificationX before 2.3.12 and WPML before 4.6.1. Sites still on those versions should update today and check for signs of compromise.

Also patched this week

These need an account, a specific setup, or an administrator's action, so they fit your next maintenance pass.

The daily roundups for October 21, October 23 and October 24 list every other plugin with its affected range, including WooCommerce extensions, two-factor, membership and directory plugins.

Supply chain and platform news

Two of this week's stories came through trusted channels rather than plugin bugs. Besides Rank Math, an attacker used a hijacked developer GitHub account on October 19 to replace the release files of OVHcloud CLI v0.11.0 through v0.15.0 with a build that looks for secrets on disk. The files were up for about an hour and a half. If you or a CI pipeline installed the CLI that day, rotate every secret that machine could read and install v0.16.0. Websites hosted on OVHcloud were not changed, but the credentials used to manage them may have been exposed.

The lesson for agencies is the same in both cases: an update from a trusted source can still be the delivery method, so keep backups from before each update and know which machines hold client credentials.

From our research

We checked the 1,000 most-installed plugins in the wordpress.org directory: 72 have not been updated in more than a year, 41 of them in more than two years, and together they report about 6.4 million active installs. Most popular plugins are well maintained, with 80% updated in the last three months. The full data and method are in our plugin maintenance study.

How to check your sites in 10 minutes

One pass per site covers most of this week:

  1. Run wp plugin list --fields=name,version,update_version and compare each name against the lists above. Any row with an update_version is behind.
  2. Run wp core version and confirm 7.1.3, or 7.0.7 on the 7.0 branch.
  3. Read the PHP version in Tools > Site Health > Info > Server. The command-line php -v can differ from the version serving web requests.
  4. If Rank Math PRO is installed, run wp user list --role=administrator and look for usernames starting with wpsupport_ or emails ending in @wp-mail.net.
  5. Delete plugins you no longer use, including inactive ones.

Our WordPress maintenance plan checklist turns this into a weekly routine.

When to get help

If a site shows unfamiliar administrators, new PHP files in wp-content/uploads, or redirects you did not set up, treat it as a possible compromise, not an update job. Our WordPress malware removal service handles cleanup, and agencies that want this checked across many sites can use a security audit.

Sources