WordPress plugin vulnerabilities: October 2026, what to check

In October 2026 three WordPress plugins received urgent security fixes, and one of them has been under attack since 7 October. On top of that, on 28 October WordPress 7.1.4 came out, which patches a bug in the update mechanism itself. If your business website runs on WordPress, give it 15 minutes today.

I explain what happened, how to check without a developer whether your website is exposed, what to do right away and what to ask your host or website contractor to do. As of 30 October 2026. Patched versions may still change, so before updating, check the plugin vendor’s website.

What happened: three plugins, one already under attack

Plugins are add-ons that give WordPress forms, bookings or faster loading. Each one is someone else’s code running on your server. When the author makes a mistake, an outsider can exploit it, often without logging in.

Bricksforge (CVE-2026-85097): under attack since 7 October

Bricksforge is a paid add-on for the Bricks page builder, bought from the vendor rather than from the wordpress.org directory. A bug in the Pro Forms form module let a person without an account upload a file to the server and run their own PHP code, which in practice means taking over the website. Patchstack, which described the attacks, rated the vulnerability 10 on the CVSS scale from 0 to 10, and Wordfence, which assigned it a CVE number, rated it 9.8. In the Patchstack warning I read that the first attack attempts were recorded late in the evening of 7 October, from 63 different IP addresses.

Patchstack gives 3.1.8.10 as the patched version. According to the vendor’s changelog, the fix is also in 4.0.0, version 4.0.1 of 8 October patches another bug in file uploads through Pro Forms, and 4.0.2 of 13 October adds further safeguards, including for the folder for temporary form files. That is why I recommend updating to 4.0.2 (the latest version as of 30 October) or newer.

LatePoint (CVE-2026-110653): customer accounts in the booking system

LatePoint is used for booking appointments and, according to the plugin’s page on wordpress.org, has more than 100,000 active installations. In versions up to 5.7.4, a person who knew a customer’s email or phone number could bypass the limit on attempts when logging in with a one-time code and get into that customer’s account: see their bookings and personal data. The fix is in version 5.7.5 of 16 October. Version 5.7.6 of 26 October patches another, less dangerous bug, so it’s best to install the latest one right away. As of 30 October, the Patchstack database has no information about attacks.

10Web Booster (CVE-2026-108587): file uploads without logging in

10Web Booster speeds up websites and compresses images. According to wordpress.org, it runs on more than 60,000 websites. In versions up to 2.34.10, an outsider could, under certain conditions, upload a file to the server and run code. Descriptions of the vulnerability link it to a paused bulk image optimization, but don’t assume it doesn’t affect you. The fix: version 2.34.11. Patchstack considers attacks likely, although as of 30 October they had not been confirmed.

Who this affects

• Websites with any of these plugins, even a deactivated one. A deactivated plugin still sits on the server.
• Websites built by an agency or a freelancer whose dashboard nobody looks at. Bricksforge is a tool for people who build websites in Bricks, so it is usually installed by the contractor, and the business owner may not even know they have it.
• Websites with paid plugins whose license has expired. Paid add-ons from outside wordpress.org usually update only with an active license key. Without it, the dashboard may not even show that a new version is available.

If your website isn’t built on WordPress, this guide doesn’t concern you. Don’t know what it runs on? I explain it in the upcoming guide “How to check your PHP version and what your website runs on”.

How to check your website in 15 minutes, without a developer

You need an administrator account in WordPress. I give the menu item names for the English-language dashboard.

1. Plugin list. Go to Plugins → Installed Plugins. Each plugin shows its version. Look for Bricksforge, LatePoint and 10Web Booster and compare the version with the table above.
2. Pending updates. In Dashboard → Updates you will see the WordPress version and the plugins that have newer releases. If something has been waiting there for weeks, it’s a sign that nobody is looking after the website.
3. Automatic updates. The plugin list has an “Automatic Updates” column. Check which plugins have them turned on. According to the documentation, WordPress installs them twice a day, but only when its task scheduler (WP-Cron) is working. Problems with the scheduler will show up in Tools → Site Health.
4. Administrator accounts. Go to Users → All Users and click the “Administrator” filter. Every account you don’t recognize is a cause for concern. A common trace of a break-in is a new administrator with a name made to look technical, for example “support” or “wpadmin”.
5. Security scanner. If you have a security plugin (e.g., Wordfence) or a scanner in the hosting panel, run a full scan. You are looking for modified WordPress files and PHP files in the images directory (wp-content/uploads). PHP files should not appear there.

When all plugins are on safe versions, you know all the administrators and the scanner found nothing, you can breathe easy. If something doesn’t add up, go on to the next sections.

What to do today

• Make a backup of your files and database, ideally in the hosting panel or with a backup plugin. With a plugin that has been under attack for several weeks, don’t put the update off “until after the weekend”: a backup and an update are a matter of minutes.
• Update the plugins from the table. You download Bricksforge from your account with the vendor or update it in the dashboard after entering the license key. Going from 3.x to 4.x is a big change, so afterwards send a test message through every form.
• Delete plugins you don’t use. Deactivating them isn’t enough. Fewer plugins means fewer places where a vulnerability can appear.
• Turn on automatic updates for simple plugins if you have a daily backup. I update booking, payment and store plugins manually, but I install security fixes within a day or two. I described the order of steps and a fallback plan in the guide how to update WordPress safely.
• Change administrator passwords and turn on two-factor authentication if a vulnerable version of Bricksforge was running on your website after 7 October. On top of that, have the file scan described below done, because changing passwords alone won’t remove a file planted by an intruder.

While you’re at it: WordPress 7.1.4 of 28 October

On 28 October WordPress 7.1.4 came out, fixing 22 vulnerabilities. The most serious is a bug during the core update process that could lead to someone else’s code running on the server. Wordfence reports that attempts to exploit it appeared just a few hours after the fix was released. According to the release notes on wordpress.org, the fixes also went into older branches, e.g., 7.0.8 and 6.9.11, while WordPress 4.6 and older no longer receive security patches.

Check which version you have in Dashboard → Updates. Such fixes usually install themselves, but only if nobody has turned off automatic core updates.

What to ask your host or website contractor to do

Some things require access to the server. These are tasks for your host or the person who looks after your website:

• reviewing the server logs for requests to Bricksforge forms since 7 October (Patchstack points to the address /wp-json/bricksforge/v1/form_submit),
• searching the wp-content/uploads directory for PHP files, including the wp-content/uploads/bricksforge/tmp/ folder and files with names starting with login_admin_,
• blocking PHP execution in the images directory, a simple server rule that makes many attacks of this kind harder,
• turning on a web application firewall (WAF) with rules for new vulnerabilities; the free version of Wordfence gets new rules with a 30-day delay (it will get the rule for the WordPress 7.1.4 vulnerability on 27 November), so with ongoing attacks the update is what matters most,
• confirming a backup stored off the website’s server and giving the date of the last successful backup.

A message you can copy:

Hello, in October security fixes were released for the Bricksforge (CVE-2026-85097), LatePoint (CVE-2026-110653) and 10Web Booster (CVE-2026-108587) plugins, along with WordPress 7.1.4. Please check whether our website [address] has any of these plugins and whether it is updated, review the administrator accounts and scan the files, and let me know when the last backup was made. Please send me a short email confirming what has been done.

If you don’t know who is responsible for updates in your case, I come back to this in the upcoming guide “Website updates: who is responsible, the host or the contractor?”

When you see signs of a break-in

An unknown administrator, PHP files in the images directory, strange redirects or a warning in Google are signs that someone has already been on your website. Then the update alone is not enough: it closes the door, but it doesn’t throw the intruder out. I described a plan for the first hour in the guide hacked WordPress: what to do.

If the website has customer accounts, for example in LatePoint, and someone may have had access to them, talk to the person responsible for GDPR at your company. A personal data breach is reported to UODO (Urząd Ochrony Danych Osobowych, Poland’s data protection authority) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of the people the data concerns (Art. 33 GDPR). This is not legal advice, just a signal not to miss the deadline.

Summary

In October one plugin came under attack and two more received urgent patches. Check your plugin list, administrator accounts and WordPress version, delete what you don’t use, and establish who is responsible for updates in your case.

If you would rather not keep track of this yourself, I take it on as part of technical maintenance. In the Watch plan (from PLN 149 net a month) I install urgent security updates within 2 days and make an off-server backup every week, Standard (from PLN 349 net) gives you a daily backup and a response within 1 business day, and Pro (from PLN 749 net) a response within 4 hours. I will check the state of your security in a security audit (from PLN 990 net), and harden the server and application in the Project cybersecurity service. Write to me, I reply within 24 hours.