October 2026 gave WordPress site owners two things to deal with. The first is core: on October 6, WordPress released 7.1.3, a maintenance and security release with seven security fixes and four bug fixes, and any site on the 7.1 series should move to it soon. The second is plugins: Bricksforge has a flaw that lets anyone upload and run PHP code without logging in, and the security firm Patchstack has seen it exploited since October 7. Around the same time, flaws in Ninja Forms and WPC Product Bundles were used in a separate campaign. What to do now: confirm your core version, check whether you run any of these plugins, and schedule an update round for everything else. The steps are below.
Compiled from the official WordPress announcements, Patchstack and security media coverage as of October 23, 2026. For affected versions, the official and plugin vendor advisories are the reference.
What core 7.1.3 fixed
7.1.3 is a maintenance and security release for the 7.1 series. According to Patchstack's breakdown, two of the issues can be started by a visitor who is not logged in: a stored cross-site scripting flaw on the Comments admin screen triggered through pending comments (it also needs a moderator to click), affecting 7.1.0 to 7.1.2, and a leak that exposes comments on private and unpublished posts. The others need a Contributor or Author account, or an administrator running an export, such as a second-order SQL injection in WXR export and Authors being able to make posts sticky.
For sites still on 6.x or other older branches, WordPress says the fixes are being backported to branches that still receive security fixes and will ship as they become ready. Separately, 7.1.2 on September 22 fixed an unauthenticated local file inclusion flaw (CVE-2026-87902), and Patchstack saw attackers start probing sites within hours of the patch. If your site is still on 7.1.1 or earlier, catch up now.
Plugins under active attack
Bricksforge (CVE-2026-85097): versions up to 3.1.8.9 let an unauthenticated visitor upload a PHP file disguised as a GIF image and run it, which means someone else can run arbitrary code on your site. The fix is 3.1.8.10. Patchstack first saw attacks on October 7, and they were automated, with dozens of identical requests within seconds. If you run this plugin, update to the latest version, then check wp-content/uploads/bricksforge/tmp/ and your other upload folders for PHP files that should not be there, especially ones whose names start with login_admin_.
Ninja Forms (CVE-2026-94504) and WPC Product Bundles (CVE-2026-93836): Patchstack documented a campaign exploiting cross-site scripting flaws in these two plugins. When it succeeds it leaves several ways back into the site, including a hidden administrator account. If you run either plugin, update to the latest version. If you suspect a compromise, an account missing from the Users screen does not mean it is not there; ask your host or a developer to compare administrator accounts directly in the database.
Checks you can do right now
First, open Dashboard, then Updates, in your admin and confirm WordPress is on 7.1.3. WordPress applies minor security releases automatically by default, but some hosts and plugins turn that off, so it is worth looking yourself.
Second, go to Plugins, then Installed Plugins, and search for Bricksforge, Ninja Forms and WPC Product Bundles. If any are installed, handle them as described above. Deactivate and delete plugins you no longer use; every plugin you remove is one less thing to track.
Third, schedule an update round for your other plugins and themes. If you are worried an update will break the site, follow the back up, update in batches, roll back approach: back up, update a few at a time, check the homepage and admin after each batch, and roll back if something breaks. Finally, make sure every administrator uses a strong password and look through the user list for administrators you do not recognize.
If you would rather not chase vulnerabilities every month
If you look after the site yourself, set aside time every week or two to review updates and keep an eye on the official WordPress release announcements. If your site is on ordinary shared hosting, ask your host whether core security updates are applied automatically; plugins and themes are usually still your job.
WordPress sites on RoamerHost get security (minor) releases applied automatically, and major upgrades run with one click in the dashboard. Plugins and themes can also be updated from the dashboard, and both plans include automatic backups. With WP × Roamer AI Advanced, you can tell Roamer AI to update all plugins, back up first and confirm the site still works afterward. It backs up, checks the homepage and admin after updating, and rolls back to the pre-update state if it finds errors or conflicts. You can also ask it for a health check covering pending updates and the error log. WordPress Basic is NT$3,588 billed yearly (NT$299 a month on average), and WP × Roamer AI Advanced is NT$11,988 billed yearly (NT$999 a month on average). Plan details are on the WP × Roamer AI page.
FAQ
Q: My site is still on 6.x. Do I have to move to 7.1?
WordPress is backporting these fixes to older branches that still receive security fixes and shipping them as they become ready, so install the new release for your branch as soon as it appears. Older branches only get security fixes, though, so the safest path is still to plan a move to 7.1; back up before a major upgrade and confirm your theme and key plugins support it.
Q: I don't run Bricksforge or the other plugins. Do I still need to do anything?
Confirm core is on 7.1.3, and schedule an update round for your other plugins too. These are the ones named as under attack in October; that does not mean other plugins are free of flaws.
Q: How do I know whether my site was compromised?
Common signs are administrators you do not recognize, PHP files in upload folders, redirects to strange sites, or content in Google results that you did not write. If something looks off, back up the current state, change every administrator password, and get your host or a developer to investigate. Deleting the files you can see is often not enough; in October, security media reported a WordPress backdoor that rebuilds itself after cleanup.
Sources
- WordPress.org: WordPress 7.1.3 Maintenance and Security Release, Version 7.1.3, Release archive
- Patchstack: WordPress 7.1.3 security release analysis, CVE-2026-87902: probing started hours after the patch, Bricksforge vulnerability exploited, The Ninja Forms and WPC Product Bundles campaign
- Security media: The Hacker News on Bricksforge, SecurityWeek on Bricksforge, The Hacker News on the self-rebuilding backdoor
- RoamerHost: WP × Roamer AI plans and FAQ
WordPress
