WordPress: 7 Critical Plugin Flaws, Late October 2026 (SimpleForm, Project Manager, PDF Invoice, Uncanny Toolkit…)

On October 31, 2026, NVD published seven critical CVEs in WordPress plugins, all reported by Wordfence. Four are rated 9.8, three 9.1. A recurring pattern: a nonce that's supposed to guard an action, but is printed into public pages or handed out by an anonymous endpoint. The check exists on paper and stops nobody.

Scores come from Wordfence as CNA. Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for the 9.8s, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H for the 9.1s. All seven are in NVD status Received (not yet analyzed) and none is in CISA KEV at the time of writing. The bounds come from the descriptions: NVD doesn't name the fixed release. Check the plugin changelog before treating a version as safe.

SimpleForm — CVE-2026-118235

A form builder. The handle_upload function derives the file extension before sanitizing the filename, so a name ending in a dot skips every extension and MIME check. An anonymous visitor can upload an executable file and run code.

Exposure condition: any page showing a SimpleForm form. The only gate is a nonce printed in the data-nonce attribute of every public form.

Action: upgrade past 3.10.2; otherwise remove forms with file fields or deactivate the plugin.

Project Manager — CVE-2026-116512

weDevs' project management and Kanban plugin. The id parameter is concatenated into a validation rule string, which is then split into PHP function names called dynamically with no allowlist. Result: unauthenticated code execution.

The detail that makes it anonymous: WordPress core runs a REST route's validate_callback before its permission_callback, so the plugin's capability check is never reached on this path.

Action: upgrade past 4.1.1. No easy workaround: the REST API is public by default.

PDF Invoice for WooCommerce — CVE-2026-109220

PDF invoice generation. The checkout "customer note" field is inlined verbatim into invoice HTML, turned back into a live tag by simplehtmldom, then fed to unserialize() by mPDF: PHP object injection leading to code execution, no account needed.

Exposure condition: a store that accepts direct bank transfer or cheque. An anonymous order through the WooCommerce Store API moves to "on-hold" automatically and triggers invoice generation.

Action: update (NVD's references point to a 7.2.0 build of the plugin). Meanwhile, disable those payment methods or the plugin.

Uncanny Toolkit for LearnDash — CVE-2026-119096

A LearnDash add-on toolkit. The account verification gate looks up the user with the raw email string, while the actual login relies on WordPress's sanitized version. Append junk characters and the gate lookup fails and gets skipped, but the login still succeeds.

Key limitation: the attacker must already know the target account's credentials. This doesn't steal passwords; it defeats account approval and suspension. An account an admin suspended becomes usable again. Wordfence's 9.8 may look generous given that prerequisite.

Action: upgrade past 3.8.2, and reset the password of any account suspended for compromise.

Acadlix LMS — CVE-2026-103882

Quizzes and online courses. A REST route deletes files without validating their path: arbitrary file deletion. Deleting wp-config.php brings back the install wizard, which opens the door to a takeover.

On paper it needs a subscriber account, but the route only checks a generic REST nonce that the plugin publishes on every frontend page. Per the description, that effectively removes the authentication requirement.

Action: upgrade past 1.1.9 or deactivate the plugin.

Popup Builder — CVE-2026-89270

Marketing popups. A single anonymous GET request sends every published popup to the trash, thanks to a missing authorization check plus a second bug in SGPopup::find(). Impact: integrity and availability, no data leak or code execution.

Action: upgrade past 4.4.5. Popups can be restored from the trash if it hasn't been emptied.

WP Booking System — CVE-2026-116557

Booking calendar. A capability check is missing on calendar note deletion: a subscriber account can delete notes on any calendar.

Worth noting: the description requires a subscriber account while Wordfence's vector says PR:N, and the described impact (deleting notes) looks limited for a 9.1. Handle it after the other six.

Action: upgrade past 2.1.0.5, and close public registration if you don't need it.

Detection

• PHP files in wp-content/uploads/: there should be none (SimpleForm, PDF Invoice).
• Anonymous on-hold WooCommerce orders with a customer note containing HTML or odd characters.
• REST API requests to the affected plugins from unknown IPs, especially Project Manager and Acadlix.
• wp-config.php: present and unmodified; a site showing the install screen is an incident.
• Logins by suspended or unapproved accounts on a LearnDash site.
• Popups in the trash with no admin action behind them.

For a comparable wave, see our article on six critical WordPress plugins from October 2026.

General Mitigation

1. Identify sites running any of these seven plugins (wp plugin list on each instance).
2. Upgrade past the NVD bounds as soon as the vendor ships a fix; otherwise deactivate the plugin.
3. Block PHP execution in wp-content/uploads/ at the web server level.
4. Make wp-config.php read-only for the web server user and keep a recent site backup.
5. When in doubt: reset administrator passwords, rotate the keys and salts in wp-config.php, audit recently modified files.

Why Continuous Monitoring of Your WordPress Plugins Matters

Seven plugins, seven mechanisms, and in most cases a safeguard that wasn't one. Across a fleet of sites, the only useful question is "which site runs which plugin, at which version", and it needs an answer before the scans start.

With cveo.tech, inventory your WordPress plugins with their versions and get alerted whenever a critical CVE hits them.