Between November 2 and 3, 2026, NVD published four critical CVEs in WordPress plugins, all reported by Wordfence. Two lead to code execution, two to arbitrary file deletion, with wp-config.php as the obvious target. What helps with triage: each one is only exploitable under a specific configuration, so the real question is which of your sites meets it.
| Plugin | CVE | Flaw class | CVSS 3.1 | NVD bounds |
|---|---|---|---|---|
| Advanced Custom Fields: Extended PRO | CVE-2026-120534 | Limited code injection | 9.8 | up to and including 0.9.2.6 |
| s2Member | CVE-2026-86596 | Remote code execution | 9.8 | up to and including 260927 |
| Ultra Addons for Contact Form 7 | CVE-2026-102435 | File deletion (deserialization) | 9.8 | up to and including 3.5.54 |
| BuddyPress XProfile Image Field | CVE-2026-120518 | Arbitrary file deletion | 9.1 | up to and including 3.1.0 |
Scores come from Wordfence as CNA: vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for the three 9.8s, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H for the 9.1. All four are in NVD status Deferred: NVD doesn't plan to analyze them, so expect no NVD score and no CPE configuration. None is in CISA KEV at the time of writing. The bounds come from the descriptions and don't name a fixed release; check each plugin's changelog.
ACF Extended PRO — CVE-2026-120534
The premium edition of ACF Extended, which adds front-end forms and more to Advanced Custom Fields. In render_field, form configuration parameters are merged into field settings without validation, then passed to call_user_func_array. An unauthenticated visitor can call arbitrary WordPress functions with arguments they control.
Exposure conditions (either one, per the description):
- an administrator enabled the non-default
shortcode_previewsetting on the targeted form; - the server lacks OpenSSL functions, so ACF Pro's
acf_decryptfalls back to unverified base64 decoding.
NVD maps the CVE to CWE-434 (dangerous file upload), which doesn't really match the described mechanism: this is a controlled function call.
Action: update past 0.9.2.6 (the ACF Extended changelog is referenced), make sure shortcode_preview is off, and confirm the PHP OpenSSL extension is loaded (php -m | grep -i openssl).
s2Member — CVE-2026-86596
A membership and restricted-content plugin with PayPal integration. strip_php_tags_deep() only strips literal <? sequences. After the attacker's value (the item_name parameter) is embedded in an email template, a placeholder cleanup step reassembles a valid <?php opener, and the code runs on the server.
Caveat: the description requires an account with custom-level access or above, while Wordfence's vector says PR:N. The references point at the plugin's PayPal notification handlers (paypal-notify-in-*).
Action: update past 260927 (a WordPress.org changeset is referenced). Meanwhile, review accounts holding custom levels.
Ultra Addons for Contact Form 7 — CVE-2026-102435
A bundle of add-ons for Contact Form 7. _getObjAttr doesn't validate file paths properly. A POP gadget chain built on WPCF7_Submission and its __destruct() lets an anonymous visitor delete arbitrary files. Delete wp-config.php and the install wizard comes back, which is one short step from a takeover.
Exposure condition: the PDF Generator add-on must be active, with a Contact Form 7 form configured to generate PDFs.
Action: update past 3.5.54; otherwise disable the PDF Generator add-on.
BuddyPress XProfile Image Field — CVE-2026-120518
Adds an image field to BuddyPress profiles. When a pending signup is activated, bpxp_image_field_update_on_user_activation() calls unlink() on a path built from visitor-supplied signup metadata: no realpath(), no check that it stays in the profile-image directory, no extension allowlist. Submitting a zero-byte file with the field_N_hidden parameter at registration is enough; the stored path is resolved against the document root on activation.
Exposure conditions: open registration and an image-type profile field on the signup form.
Action: update past 3.1.0 once a fix ships; until then, close public registration or remove the image field from the signup form.
Detection
wp-config.php: present and unmodified; a site showing the install screen is an incident.- Recent BuddyPress signups with an empty image field or path-like values in their metadata (
../, absolute paths). - Emails generated by s2Member containing PHP fragments, and hits on the PayPal notification scripts from unexpected IPs.
- ACF Extended forms with
shortcode_previewenabled, and PHP servers without OpenSSL. - Recently modified PHP files under
wp-content/since November 2.
For the previous wave, see our article on seven critical WordPress plugins from late October 2026.
General Mitigation
- Identify sites running any of these four plugins (
wp plugin liston each instance). - Check each exposure condition: that's what sets the urgency.
- Update past the NVD bounds as soon as the vendor ships a fix; otherwise disable the plugin or the affected add-on.
- Make
wp-config.phpread-only for the web server user and keep a recent site backup. - When in doubt: reset administrator passwords, rotate the keys and salts in
wp-config.php, audit recently modified files.
Why Continuous Monitoring of Your WordPress Plugins Matters
All four flaws depend on a setting, an add-on or a registration option: the same plugin can be critical on one site and harmless on the next. You still need to know which sites run it, and at which version.
With cveo.tech, inventory your WordPress plugins with their versions and get alerted whenever a critical CVE hits them.