Story · 4 sources · 6 articlesfirst Oct 6, 08:59 UTCupdated Oct 8, 11:28 UTC (13h ago)

Exploited WordPress plugin flaws accompany core 7.1.3 fixes

highExploit / PoCexploited in the wildimportance 76CVE-2026-93836 CVE-2026-94504 CVE-2026-85097 CVE-2026-87902

What's new: Patchstack’s October 8 report adds active exploitation of CVE-2026-85097, a CVSS 10.0 unauthenticated arbitrary file upload in Bricksforge through 3.1.8.9, fixed in 3.1.8.10 and first observed October 7, 2026, with telemetry from 63 source IPs.

Merged summary · grok-4.7 · rewritten as coverage arrives

Attackers exploit stored XSS in two WordPress plugins and a critical Bricksforge upload flaw, while core 7.1.3 patches seven separate issues.

Patchstack and BleepingComputer describe active but currently limited exploitation of two unrelated stored XSS flaws that load the same JavaScript from imgcdn1.com and then use an administrator session. CVE-2026-93836 affects WPC Product Bundles for WooCommerce through 8.6.6 (about 30,000 installs per Patchstack, more than 30,000 sites per BleepingComputer, CVSS 7.1), first seen October 4, 2026, and CVE-2026-94504 affects Ninja Forms through 3.15.3 (about 500,000 versus more than 500,000, CVSS 7.1), with Patchstack dating that payload to October 5 while BleepingComputer dates the shared script to October 4. The payload installs a plugin that BleepingComputer names WP Smart Thumbnails, creates a hidden administrator and secret login, exposes an unauthenticated file manager, backdates files, and reports to attacker infrastructure; updating to Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7 or later stops new exploitation but does not remove infections. Separately, WordPress 7.1.3, released October 6, 2026, ships seven security fixes and four bug fixes, including comments stored XSS in 7.1.0–7.1.2, WXR second-order SQL injection, denial of service in WP_Http::make_absolute_url(), Author sticky-post abuse, unauthenticated disclosure of comments on private and unpublished posts, Imgur oEmbed XSS, and forgeable hook parameters, and no source links it to the plugin campaign. WordPress.org says fixes are backported through 4.7 and, with Cyber Security News, urges an immediate update, while Patchstack says backports go through 6.6, calls the release not an emergency, and adds that 7.1.2 fixed CVE-2026-87902 (unauthenticated local file inclusion that could lead to remote code execution), with branches 4.7–6.5 not yet patched and cached Imgur embeds remaining until caches are cleared. On October 8 Patchstack reported active exploitation, first seen October 7, of CVE-2026-85097, a CVSS 10.0 unauthenticated arbitrary file upload in Bricksforge through 3.1.8.9 (fixed in 3.1.8.10) that can place PHP files and enable remote code execution, with telemetry from 63 source IPs.

CVE-2026-93836 affects WPC Product Bundles for WooCommerce through 8.6.6 (about 30,000 installs per Patchstack; more than 30,000 sites per BleepingComputer; CVSS 7.1), with exploitation first seen October 4, 2026.
CVE-2026-94504 affects Ninja Forms through 3.15.3 (about 500,000 installs per Patchstack; more than 500,000 per BleepingComputer; CVSS 7.1); 3.15.4 strengthens output escaping. Patchstack dates that payload to October 5, while…

VendorsBricksforge WordPress

ProductsWordPress WPC Product Bundles for WooCommerce Ninja Forms WooCommerce Bricksforge Bricks Builder

MalwareWP Smart Thumbnails

OrganizationsPatchstack Trail of Bits Anthropic WordPress

Coverage timelineoldest first · each row is one article

Oct 6, 08:59 UTC · 2d ago
Patchstack· 76
Four ways back in: the WordPress XSS campaign that hides its own admin account
Attackers are exploiting stored XSS in two WordPress plugins to install hidden admin backdoors.
Oct 6, 17:00 UTC · 2d ago
WordPress.org · Security· 60
WordPress 7.1.3 Maintenance and Security Release
WordPress 7.1.3 fixes seven vulnerabilities, including stored XSS, SQL injection, and unauthenticated disclosure of private comments.
Oct 6, 19:34 UTC · 2d ago
Patchstack· 64
WordPress 7.1.3 Security Release
WordPress 7.1.3 patches seven flaws, including unauthenticated comment leaks and stored XSS, and is not an emergency.

Vulnerabilities in this storyAll →

CVE-2026-850979.8—
Unauthenticated file upload to RCE in WordPress Bricksforge
published 17h ago· Bricksforge
CVE-2026-879028.140%
Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)
published 16d ago· WordPress (WordPress.org) WordPress core

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-85097	Unauthenticated file upload to RCE in WordPress Bricksforge The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload (CWE-434) in versions up to and including 3.1.8.9 because an attacker-controlled URL in the temporaryFileUploads parameter is not sufficiently validated during form submission. An unauthenticated attacker can cause a file that passed temporary upload checks to be referenced with a PHP extension and executed by the server. Successful exploitation allows arbitrary PHP code execution and can fully compromise the site (confidentiality, integrity, and availability), with a CVSS 3.1 score of 9.8. WordPress sites running Bricksforge 3.1.8.9 or earlier are affected. No public proof of concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog. Do: Update Bricksforge to a release newer than 3.1.8.9 as soon as the vendor publishes a fix; the advisory data does not name a patched version. Until then, deactivate the plugin or otherwise block unauthenticated access to its form handling, and review the temporary and public upload directories for unexpected PHP files.	9.8	—		Bricksforge up to and including 3.1.8.9	—	17h ago
CVE-2026-87902	Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) WordPress core's page-template resolution in get_page_template() contains an unauthenticated local file inclusion flaw (CWE-98): a remote attacker with no account can influence which template file WordPress includes, causing it to load a chosen readable local .php file from outside the active theme directories. If certain pre-conditions hold on both the server and the active theme — most notably the existence of an attacker-readable .php file on disk, such as content in an uploads directory — the included file's code executes, escalating the LFI to full remote code execution over the site (CVSS 8.1, high impact to confidentiality, integrity, and availability). The high attack-complexity rating reflects these pre-conditions, but successful exploitation requires no privileges and no user interaction. All sites running WordPress core versions prior to the 7.1.2 security release are affected and should treat this as a priority patch. The issue is fixed in WordPress 7.1.2; there is no public proof of concept, it is not in the CISA KEV catalog, and no exploitation in the wild is currently known. Do: Update to WordPress 7.1.2 immediately via Dashboard → Updates (or WP-CLI), and enable automatic updates for security releases so future fixes land without delay. As defense-in-depth against the LFI-to-RCE path, block PHP execution in wp-content/uploads and any other web-writable directories at the web-server level, since RCE depends on including a readable .php file. Afterwards, audit uploads and web logs for unexpected .php files and anomalous template-selection requests.	8.1	40%	KEV PoC ×23	WordPress (WordPress.org) WordPress core All versions prior to 7.1.2	massorder of hundreds of millions of sites (WordPress powers roughly 40%+ of all websites)	16d ago KEV Sep 25, 2026
CVE-2026-93836	Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce The WPC Product Bundles for WooCommerce plugin for WordPress contains a stored cross-site scripting vulnerability in all versions up to and including 8.6.6, caused by insufficient sanitization of the 'qty' parameter. Because quantity validation uses a float cast, a numeric-prefixed script payload can pass the check while its malicious HTML survives intact and is stored verbatim in order item metadata under the '_woosb_ids' key. An unauthenticated attacker can exploit this by submitting a crafted bundle quantity, and the injected script executes in the browser of any user — including store staff or administrators — who views the affected page or order. Any site running the plugin at or below version 8.6.6 with WooCommerce is affected. No public proof of concept is known and the flaw is not on the CISA KEV catalog, so exploitation is not currently observed. Do: Update to the latest version of WPC Product Bundles for WooCommerce (anything newer than 8.6.6) as soon as a patched release is available. Audit order item metadata for the '_woosb_ids' key and look for numeric-prefixed values containing unexpected HTML or script tags, and remove any found entries. Until patched, apply a WAF rule blocking HTML/script characters in 'qty' parameters on bundle add-to-cart requests, and remind admins to view orders only in sanitized contexts.	7.2	—		WPClever WPC Product Bundles for WooCommerce (WordPress plugin) All versions up to and including 8.6.6	large≈30,000–40,000 WooCommerce sites (tens of thousands of active installs)
CVE-2026-94504	Stored XSS in Ninja Forms 3.15.3 Legacy Submission Editor Ninja Forms 3.15.3 stores values submitted through anonymous (no login required) non-rich-text textarea fields and renders them in the legacy submission editor without safe HTML encoding, allowing an attacker to break out of the textarea with injected script. When an administrator opens the direct submission URL for that entry in wp-admin, the script executes in the WordPress admin origin, enabling session hijacking, unauthorized administrative actions, or creation of a backdoor admin account. Any WordPress site running this version with public forms whose submissions are viewed in the legacy editor is affected. There is no known public proof-of-concept, no CISA KEV entry, and no observed in-the-wild exploitation, but the attack only requires submitting a crafted form entry and getting an admin to view it (CVSS 3.1: 7.2, AV:N/AC:L/PR:N). Do: Upgrade Ninja Forms from 3.15.3 to the latest patched release from WordPress.org as soon as possible. Review stored submissions for HTML/script breakout in textarea fields, and audit for unexpected administrator accounts, changed settings, or newly installed plugins/themes that could indicate a hijacked admin session. As defense in depth, restrict submission viewing to trusted roles and treat links to specific submission URLs from untrusted sources with caution.	7.2	<1%	PoC	Saturday Drive Ninja Forms (WordPress plugin) 3.15.3

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-85097

Unauthenticated file upload to RCE in WordPress Bricksforge

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload (CWE-434) in versions up to and including 3.1.8.9 because an attacker-controlled URL in the temporaryFileUploads parameter is not sufficiently validated during form submission. An unauthenticated attacker can cause a file that passed temporary upload checks to be referenced with a PHP extension and executed by the server. Successful exploitation allows arbitrary PHP code execution and can fully compromise the site (confidentiality, integrity, and availability), with a CVSS 3.1 score of 9.8. WordPress sites running Bricksforge 3.1.8.9 or earlier are affected. No public proof of concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Update Bricksforge to a release newer than 3.1.8.9 as soon as the vendor publishes a fix; the advisory data does not name a patched version. Until then, deactivate the plugin or otherwise block unauthenticated access to its form handling, and review the temporary and public upload directories for unexpected PHP files.

9.8

—

Bricksforge up to and including 3.1.8.9

—

17h ago

CVE-2026-87902

Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)

WordPress core's page-template resolution in get_page_template() contains an unauthenticated local file inclusion flaw (CWE-98): a remote attacker with no account can influence which template file WordPress includes, causing it to load a chosen readable local .php file from outside the active theme directories. If certain pre-conditions hold on both the server and the active theme — most notably the existence of an attacker-readable .php file on disk, such as content in an uploads directory — the included file's code executes, escalating the LFI to full remote code execution over the site (CVSS 8.1, high impact to confidentiality, integrity, and availability). The high attack-complexity rating reflects these pre-conditions, but successful exploitation requires no privileges and no user interaction. All sites running WordPress core versions prior to the 7.1.2 security release are affected and should treat this as a priority patch. The issue is fixed in WordPress 7.1.2; there is no public proof of concept, it is not in the CISA KEV catalog, and no exploitation in the wild is currently known.

Do: Update to WordPress 7.1.2 immediately via Dashboard → Updates (or WP-CLI), and enable automatic updates for security releases so future fixes land without delay. As defense-in-depth against the LFI-to-RCE path, block PHP execution in wp-content/uploads and any other web-writable directories at the web-server level, since RCE depends on including a readable .php file. Afterwards, audit uploads and web logs for unexpected .php files and anomalous template-selection requests.

8.1

40%

KEV PoC ×23

WordPress (WordPress.org) WordPress core All versions prior to 7.1.2

massorder of hundreds of millions of sites (WordPress powers roughly 40%+ of all websites)

16d ago

KEV Sep 25, 2026

CVE-2026-93836

Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce

The WPC Product Bundles for WooCommerce plugin for WordPress contains a stored cross-site scripting vulnerability in all versions up to and including 8.6.6, caused by insufficient sanitization of the 'qty' parameter. Because quantity validation uses a float cast, a numeric-prefixed script payload can pass the check while its malicious HTML survives intact and is stored verbatim in order item metadata under the '_woosb_ids' key. An unauthenticated attacker can exploit this by submitting a crafted bundle quantity, and the injected script executes in the browser of any user — including store staff or administrators — who views the affected page or order. Any site running the plugin at or below version 8.6.6 with WooCommerce is affected. No public proof of concept is known and the flaw is not on the CISA KEV catalog, so exploitation is not currently observed.

Do: Update to the latest version of WPC Product Bundles for WooCommerce (anything newer than 8.6.6) as soon as a patched release is available. Audit order item metadata for the '_woosb_ids' key and look for numeric-prefixed values containing unexpected HTML or script tags, and remove any found entries. Until patched, apply a WAF rule blocking HTML/script characters in 'qty' parameters on bundle add-to-cart requests, and remind admins to view orders only in sanitized contexts.

7.2

—

WPClever WPC Product Bundles for WooCommerce (WordPress plugin) All versions up to and including 8.6.6

large≈30,000–40,000 WooCommerce sites (tens of thousands of active installs)

CVE-2026-94504

Stored XSS in Ninja Forms 3.15.3 Legacy Submission Editor

Ninja Forms 3.15.3 stores values submitted through anonymous (no login required) non-rich-text textarea fields and renders them in the legacy submission editor without safe HTML encoding, allowing an attacker to break out of the textarea with injected script. When an administrator opens the direct submission URL for that entry in wp-admin, the script executes in the WordPress admin origin, enabling session hijacking, unauthorized administrative actions, or creation of a backdoor admin account. Any WordPress site running this version with public forms whose submissions are viewed in the legacy editor is affected. There is no known public proof-of-concept, no CISA KEV entry, and no observed in-the-wild exploitation, but the attack only requires submitting a crafted form entry and getting an admin to view it (CVSS 3.1: 7.2, AV:N/AC:L/PR:N).

Do: Upgrade Ninja Forms from 3.15.3 to the latest patched release from WordPress.org as soon as possible. Review stored submissions for HTML/script breakout in textarea fields, and audit for unexpected administrator accounts, changed settings, or newly installed plugins/themes that could indicate a hijacked admin session. As defense in depth, restrict submission viewing to trusted roles and treat links to specific submission URLs from untrusted sources with caution.

7.2

<1%

PoC

Saturday Drive Ninja Forms (WordPress plugin) 3.15.3