BitNinja 7 new WordPress plugin vulnerabilities

Seven WordPress plugin vulnerabilities covered by new WAF rules, two of them are unauthenticated takeover bugs.

BitNinja added seven rules to WAF2 and WAF Pro on November 3, 2026. The rules cover WordPress plugins, including vulnerabilities that can let an attacker upload files, run code, or perform administrative actions without authentication. Yet another bad day to be a WordPress hoster it seems... Lots of threats are found on a daily basis, and an (*alarmingly) *increasing number of public PoCs are available for them.

For hosting providers and server owners, these attacks can lead to webshells and full site takeover. Virtual patching gives affected sites protection while administrators apply updates. Plugin updates are still required, and plugins without a fix should be removed where possible.

Rule 410057: YOOtheme Pro

CVE-2026-102785 affects the image handler in YOOtheme Pro. The vulnerability allows operation injection through the image handler.

BitNinja rule 410057 covers this issue. Site owners should update YOOtheme Pro when a fixed version is available.

Rule 406065: WBW Product Filter

CVE-2026-112866 affects WBW Product Filter. The issue involves the product filter's attribute slug, which accepts disallowed characters.

BitNinja rule 406065 provides WAF coverage for the vulnerability. Administrators should apply the vendor's fix when available.

Rule 406066: Checkout Files Upload for WooCommerce

CVE-2026-103688 is an unauthenticated arbitrary file upload vulnerability in Checkout Files Upload for WooCommerce versions below 2.4.0. The vulnerability is actively exploited, and a public proof of concept is available.

An attacker can upload files without logging in. On a hosted WordPress site, this type of access can lead to a webshell and site takeover.

BitNinja rule 406066 protects affected sites at the WAF while administrators update the plugin to version 2.4.0 or later.

Rule 406067: Contact Form 7

Contact Form 7 versions 6.2 through 6.2.3 contain an unauthenticated arbitrary file upload vulnerability. The issue is fixed in version 6.2.4.

BitNinja rule 406067 covers the upload attack. Site owners should update Contact Form 7 to version 6.2.4 or later.

Rule 406068: s2Member

CVE-2026-86596 affects s2Member versions up to 260927. The vulnerability allows unauthenticated remote code execution through the PayPal IPN item_name parameter. A public proof of concept was published on November 2, 2026.

The same BitNinja rule also covers the s2 shortcode injection variant. Rule 406068 helps block these attacks while administrators update the plugin.

Rule 406069: Ultra Addons for Contact Form 7

CVE-2026-102435 affects Ultra Addons for Contact Form 7 versions up to 3.5.54. It is a PHP object injection vulnerability that can lead to file deletion.

BitNinja rule 406069 provides WAF protection for this issue. Administrators should update to a fixed version when one is available.

Rule 406070: CryptoPayment Gateway

CVE-2026-81648 affects CryptoPayment Gateway versions 1.2.1 and 1.2.2. The vulnerability allows an unauthenticated administrative action through an unguarded AJAX router.

The issue is being exploited, and no patch is available. BitNinja rule 406070 provides virtual patching for affected sites. Until a fix is released, site owners should remove the plugin if they do not need it.

Protection at the hosting layer

These plugins can be installed across many shared-hosting WordPress sites. A single vulnerable installation can become an entry point for malicious uploads, code execution, or further attacks against a site.

BitNinja customers are protected by the new rules without changes to the hosted sites. This gives administrators time to update vulnerable plugins, or remove them when no safe version exists.

One thing is important to note: WAF protection does not replace plugin maintenance. Hosting teams should still check affected installations, apply the available fixes, and remove CryptoPayment Gateway until a patch is released.

Let's hope we will not see more 9+ CVEs in the upcoming days.

Stay safe, stay Ninjastic!