{"id":1784,"date":"2026-10-05T13:50:50","date_gmt":"2026-10-05T16:50:50","guid":{"rendered":"https:\/\/www.linuxpro.com.br\/?p=1784"},"modified":"2026-10-05T13:56:41","modified_gmt":"2026-10-05T16:56:41","slug":"wordpress-cves-da-semana-e-como-se-proteger","status":"publish","type":"post","link":"https:\/\/www.linuxpro.com.br\/en\/2026\/10\/wordpress-cves-da-semana-e-como-se-proteger\/","title":{"rendered":"WordPress: this week's CVEs and how to stay safe"},"content":{"rendered":"

\"Mascote<\/p>\n

Updating only the WordPress core does not fix a flaw in a plugin. In the week of 28 through 4 of 2026<\/strong>, advisories involving ConvertPlus, WPMobile.App, Download Monitor, and CTX Feed Pro showed different risks: PHP object injection, account takeover, and persistent malicious JavaScript. See what to check, which versions to look for, and how to reduce exposure while the fix is not yet in production.<\/p>\n

Reporting in 05\/10\/2026.<\/strong> This is a selection of four relevant CVEs, not a complete inventory of the week. The dates below are from public disclosure by Wordfence; in the three advisories for 01\/10, the CVE records were published in 02\/10. There is also an earlier core alert, set apart because it already has confirmed exploitation.<\/p>\n

CVEs of the week: affected components and fixes<\/h2>\n\n\n\n\n\n\n\n\n
Component and CVE<\/th>\nDisclosure<\/th>\nAffected versions<\/th>\nAction<\/th>\n<\/tr>\n<\/thead>\n
ConvertPlus
CVE-2026-87741<\/a><\/td>\n		28\/09\/2026<\/td>\nUp to 3.6.3<\/td>\nUpdate to 3.6.4 or a later fixed version.<\/td>\n<\/tr>\n
WPMobile.App
CVE-2026-94541<\/a><\/td>\n		01\/10\/2026<\/td>\nUp to 11.82<\/td>\nThe advisory recommends 11.85 or a later fixed version.<\/td>\n<\/tr>\n
Download Monitor
CVE-2026-100182<\/a><\/td>\n		01\/10\/2026<\/td>\nUp to 5.2.10<\/td>\nApply the security update 5.2.11 or a later fixed version.<\/td>\n<\/tr>\n
CTX Feed Pro
CVE-2026-10026<\/a><\/td>\n		01\/10\/2026<\/td>\nThrough 7.6.12<\/td>\nNo known fix in the advisory consulted on 05\/10\/2026. Evaluate deactivation and replacement.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

ConvertPlus: a subscriber login is enough to reach the flaw<\/h3>\n

Insecure deserialization allows an authenticated user with subscriber or higher capabilities to inject a PHP object. The impact depends on a POP chain<\/em>: a sequence of class behaviors in another plugin or theme. The advisory does not identify that chain within ConvertPlus itself. Therefore, it is not correct to advertise guaranteed remote code execution across every installation. The reference assigns CVSS 3.1 of 8,8<\/strong>.<\/p>\n

Update through the vendor's official channel. If the plugin came bundled with a theme, check whether the distributor already provides the fix. Without access to the patched package, disable the component and plan its removal or replacement; first assess the popups and forms that depend on it. Blocking new signups does not eliminate already existing accounts.<\/p>\n

WPMobile.App: a recovery email cannot become a public push<\/h3>\n

With mail-to-push<\/em> enabled, password reset links can be copied into an accessible queue without authentication. This allows accounts to be taken over, including administrative ones. The advisory assigns CVSS 3.1 of 9,8<\/strong> and recommends version 11.85<\/strong>.<\/p>\n

The developer changelog<\/a> records a temporary deactivation of the feature in 11.83, reinforcement in 11.84, and another security fix in 11.85. Do not treat the interim solution as the end point. If you cannot update, shut down the feature and disable the plugin until you can patch it. Turning off sending does not prove that previously queued data has been deleted; ask the vendor for guidance on cleaning and invalidating links, preserving evidence if there is suspicion of abuse.<\/p>\n

Download Monitor: the administrator is also part of the attack path<\/h3>\n

The persistent XSS involves messages between browser pages and the download editing screen. According to the CVE record, the attacker needs to trick an authenticated administrator into visiting a page controlled by them, targeted at an open download editor. It is not a zero-interaction exploit just because the attacker does not need an account.<\/p>\n

The official changelog<\/a> lists the security update 5.2.11 in 28\/09\/2026<\/strong>, before disclosure. Update; in the meantime, avoid external browsing on the same profile used to manage the site and close the affected screen. This reduces the opportunity, but it does not replace the patch. Investigate already-altered content: fixing the plugin does not automatically remove a script that may have been written beforehand.<\/p>\n

CTX Feed Pro: PHP execution requires administrative access<\/h3>\n

A CVE-2026-10026<\/strong> affects the CTX Feed Pro through 7.6.12<\/strong>. The field Feed Config<\/em> reaches the function eval()<\/code> without sufficient validation, allowing arbitrary PHP to be executed on the server. The attacker must be authenticated as an administrator or higher<\/strong>: it is not an intrusion available to any visitor. The Wordfence advisory<\/a>, disclosed on 01\/10, assigns CVSS 3.1 of 7,2<\/strong>; the CVE record was published in 02\/10.<\/p>\n

No known fix in the query at 05\/10\/2026.<\/strong> Do not assume that a later version fixes the flaw without confirmation from the vendor. Consider disabling and removing the component, after exporting the settings and planning an alternative for the commercial feeds. The disruption may affect the update of the catalogs used in campaigns and marketplaces.<\/p>\n

While you arrange the replacement, reduce administrative access, require MFA, and review changes to the plugin settings. These measures reduce the risk of account abuse, but they do not fix the code. Disabling the file editor with DISALLOW_FILE_EDIT<\/code> also does not block this path via eval()<\/code>. If you suspect improper execution, follow the incident response procedure below.<\/p>\n

Earlier alert: the core flaw remains a priority<\/h2>\n

A CVE-2026-87902<\/strong> was disclosed on 22\/09\/2026<\/strong>, outside the selected week. The official WordPress advisory<\/a> describes improper inclusion of a local PHP file while resolving templates. Exploitation depends on the active theme containing a top-level directory whose name starts with page-<\/code> and on a usable, readable local PHP file; whether it escalates to remote code execution also depends on the environment.<\/p>\n

Among the fixes are 7.1.2, 7.0.6, 6.9.9 and 6.8.10<\/strong>, each in its respective series. The advisory lists the other branches. This does not mean that every version numerically lower than 7.1.2 remains vulnerable: there are backports.<\/p>\n

The Canadian Centre for Cyber Security<\/a> confirmed exploitation in the wild and reported inclusion in the CISA KEV catalog at 25\/09. Prioritize the update. MFA on the dashboard does not fix an inclusion of a file accessible without login.<\/p>\n

Defense in layers: where each protection acts<\/h2>\n

The diagram presents a reference logical architecture: the WAF filters requests before the application, WordPress receives the patches, the database remains in a private connection, and the backups stay separate. Logs help investigate; backup helps recover. None of these layers turn vulnerable code into fixed code.<\/p>\n

\"Diagrama
Defense in depth: filters reduce exposure, patches fix the code, and separate backups let you recover the environment.<\/figcaption><\/figure>\n

In an edge WAF, confirm specific coverage for the CVE, that the rule is enabled, and the paths through which the origin server can still be reached directly. Do not block the entire REST API or the whole admin-ajax.php<\/code> blindly: that can break the site without addressing the cause. Legitimate integrations, such as WordPress automation via MCP<\/a>, also use the API.<\/p>\n

Fix playbook with WP-CLI<\/h2>\n

The examples are for a simple installation with WP-CLI already installed, run by the user who administers the files \u2014 not by root. Replace the path. On managed hosting, use the panel or ask the provider to run them. In Multisite, plan the update and testing for the entire network. Do not run these commands as triage on a possibly compromised environment:<\/strong> commands that load WordPress can execute tampered code; in that case, isolate and preserve a copy first.<\/p>\n

1. Inventory before changing<\/h3>\n
cd \/var\/www\/seu-site\nwp core version\nwp plugin list --fields=name,status,version,update,update_version\nwp theme list --fields=name,status,version,update\n<\/code><\/pre>\n
Compare the technical name, version, and conditions of each advisory. The slugs involved are convertplug<\/code>, wpappninja<\/code>, download-monitor<\/code> and webappick-product-feed-for-woocommerce-pro<\/code>. For CTX Feed Pro, with no known patch at the time of investigation, follow the mitigation from the dedicated section; there is no update command in this script that is proven to be corrective. Do not install one just to follow the example. The absence of an update in the panel does not prove safety, especially in commercial plugins. References: plugin inventory<\/a> and themes<\/a>.<\/p>\n
2. Prepare a working recovery<\/h3>\n
Before maintenance, ensure a consistent copy of the files and the database outside the public root and test the restore in an isolated environment. In stores, plan how to preserve orders received during the window. Do not leave a SQL dump in public_html<\/code>. See the guide on backup with tested restore<\/a>.<\/p>\n
3. Update effectively installed components<\/h3>\n
# Veja primeiro o que seria atualizado; n\u00e3o altera os plugins.\nwp plugin update --all --dry-run\n\n# N\u00facleo: atualiza para a vers\u00e3o est\u00e1vel oferecida pelo WordPress.org.\n# Teste antes a compatibilidade se houver mudan\u00e7a de s\u00e9rie.\nwp core update\nwp core update-db\n\n# Execute apenas as linhas dos plugins presentes no seu invent\u00e1rio.\nwp plugin update wpappninja\nwp plugin update download-monitor\nwp plugin update convertplug\n<\/code><\/pre>\n
The last command depends on the commercial update channel being configured. If it fails or keeps offering a vulnerable release, get the package from the vendor; do not use ZIPs from third parties. The versions in the table are references for the fix, not a reason to downgrade. The option wp core update --minor<\/code> limits the update to the current series, but you still need to check whether it received the fix. Documentation: core update<\/a>, update-db<\/a> and plugin update<\/a>.<\/p>\n
4. Verify integrity and operation<\/h3>\n
wp core version\nwp plugin list --fields=name,status,version,update\nwp core verify-checksums --include-root\nwp plugin verify-checksums --all\n<\/code><\/pre>\n
The core checksums<\/a> and the plugin checksums<\/a> compare files against WordPress.org references. Commercial or proprietary components may not have checksums available. Mismatches require investigation, not automatic deletion; a clean result does not scan the entire database nor prove the absence of an intrusion.<\/p>\n
Check login, public pages, forms, downloads, password recovery, and application features. Clear the affected caches after the update and watch for errors. These commands were verified against the documentation; they do not represent exploitation tests nor an audit of your server.<\/p>\n
Best practices that reduce risk<\/h2>\n