Security · IHS Blog

WordPress security roundup, October 2026: PHP2Shell, Rank Math PRO, Ninja Forms and Bricksforge

By the Intelligent Hospitality Systems Team · Published October 23, 2026

Updated October 23, 2026 · Versions and status as reported by the sources listed below.

PHP2Shell (PHP itself)

CVE-2026-109618 and CVE-2026-109619, CVSS 9.2. Affects PHP 5.4 through 8.5.11; fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 21). Mass exploit attempts, no confirmed successful compromise as of October 23. Full guide.

Rank Math SEO PRO 3.0.123 (supply chain)

For about eleven hours on October 15 to 16, some copies of Rank Math SEO PRO 3.0.123 from the vendor's own download channel contained malware, per WP Server Guard. A site that activated one should be treated as compromised; updating to 3.0.124 does not undo it.

Ninja Forms and WPC Product Bundles

CVE-2026-94504 (Ninja Forms 3.15.3 and older) and CVE-2026-93836 (WPC Product Bundles for WooCommerce 8.6.6 and older), stored cross-site scripting used to plant backdoors and rogue admin accounts, per BleepingComputer. Fixed in 3.15.4 and 8.6.7. Updating does not clean an existing infection.

Bricksforge

CVE-2026-85097, CVSS 9.8, unauthenticated file upload leading to code execution in Bricksforge 3.1.8.9 and earlier, exploited from October 7 per SecurityWeek. Fixed in 3.1.8.10.

What to do

  • Patch PHP and update plugins.
  • Check for admin accounts you didn't create.
  • If a site may be compromised, restore from a clean backup and change all passwords.

Tired of patch weeks? We convert WordPress to HTML for free.

Want off WordPress? We convert WordPress sites to fast, secure static HTML on our platform for free, and keep your URLs and Google rankings intact.

See how free conversion works

Sources