WordPress News: Three Plugin Vulnerabilities Patched (Week of 6 October 2026)

This was a plugin week, not a WordPress core week. No major core release landed in the last seven days, but three separate plugin vulnerabilities did, and one of them is serious enough that you should stop reading this and check your site after you finish this paragraph. The theme, as usual, is that the risk to your business rarely comes from WordPress itself; it comes from the plugins sitting on top of it.

Update Beaver Builder today if you use it

On October 2, 2026, Wordfence researchers disclosed a critical vulnerability in Beaver Builder Page Builder, scoring 9.1 out of 10 on severity. The flaw affects all versions up to 2.11.0.5 and lets an attacker who isn't even logged in execute arbitrary shortcodes on your site. The practical attack is almost comically low-effort: if your Beaver Builder page includes a Sidebar module showing the built-in Recent Comments widget, and comment moderation isn't locking things down, someone can leave a crafted comment that turns into working code on your page. It doesn't take a fully armed and operational battle station to compromise a WordPress site; sometimes all it takes is one unmoderated comment box.

What this means for you: If you use the Beaver Builder plugin (not the separate Beaver Builder theme), update to version 2.11.0.6 immediately, and check that comment moderation is switched on. If you're not sure which page builder your site runs, that's a question your developer or maintenance provider should be able to answer in under a minute.

Page builders like Beaver Builder are genuinely useful for most business sites, but incidents like this are a reminder that every plugin you add is one more thing that needs watching. For businesses whose sites have grown well past "a few pages with a drag-and-drop builder," into something closer to a real application, a custom-built theme can end up being the more secure and more maintainable choice than stacking more builder plugins on top of each other.

Check your SMTP plugin too, if you run a multisite network

On October 5, 2026, Wordfence disclosed a stored cross-site scripting vulnerability in Post SMTP, one of the most widely used plugins for handling WordPress outgoing email. The bug, rated 7.2, affects versions up to 4.0.1 and is fixed in 4.0.2. It's specifically exploitable on WordPress Multisite installations that have public user registration turned on; a crafted email address gets logged verbatim into Post SMTP's failed-send log and executes when an administrator views it.

What this means for you: If you run a single WordPress site, which is most businesses, your exposure here is low. If you run a multisite network with open registration, which is less common but not rare among membership or franchise sites, treat this one seriously. Either way, update to 4.0.2. There's no good reason to leave a known fix sitting unapplied, and a hacked site is a far more expensive problem than a five-minute update.

A smaller plugin you've probably never heard of, patched for a reason

Also disclosed on October 5, 2026, was a remote code execution vulnerability in ACPT (Premium), rated 8.8. ACPT (Advanced Custom Post Type) is a plugin for building custom content types and forms, more common on membership sites and directories than on standard brochure or ecommerce sites. The flaw allows anyone with even a basic "subscriber" level account, the kind self-registered visitors often get automatically, to create a malicious form through the plugin's REST API and trigger code execution when that form is submitted. It's fixed in version 2.0.67.

What this means for you: If the name ACPT doesn't ring a bell, you almost certainly don't run it, and you're fine. If you do run it, update now and take a moment to review who on your site actually has subscriber-level access, since that's the minimum needed to exploit this one.

The pattern worth noticing

None of these three issues are world-ending on their own, but three patchable plugin vulnerabilities surfacing in a single week is completely normal for the WordPress ecosystem, not an anomaly. That's the real takeaway. Most WordPress compromises trace back to an outdated plugin that nobody got around to updating, not to some sophisticated nation-state attack. Keep the plugins you need, remove the ones you don't, and update promptly when a fix comes out.

If staying on top of this every week isn't something you or your team has time for, that's precisely the gap a maintenance plan is built to close: updates get applied, monitored, and tested without it landing on your to-do list.

May the Code Be With You.