This week's virtual patches: nine new WAF rules

BitNinja added nine WAF rules against vulerabilities found in 8 plugins, and an authenticated Roundcube IMAP command injection.

The rules provide server-level virtual patching via both WAF 2.0 and WAF Pro while customers apply the vendor updates. As always, software updates remain the complete fix.

Rules released on 10 November

SliceWP Affiliates: unauthenticated SQL injection

Rule 406080 covers CVE-2026-120043 in Affiliate Program Suite (SliceWP Affiliates) versions up to and including 1.2.14.

An attacker can inject SQL through the email parameter on the WooCommerce My Account registration flow without authenticating. Wordfence rates the issue CVSS 7.5. Patchstack rates it 9.3 and lists it as known exploited in the Patchstack KEV. This is not a CISA KEV listing.

The issue is fixed in version 1.2.15.

Craft CMS: unauthenticated SQL injection

Rule 406082 covers CVE-2026-123488 in Craft CMS 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1.

The vulnerable element search endpoint allows stacked SQL statements. Successful exploitation can modify the database, including admin flags or password hashes. The issue has a public proof of concept released on 6 November 2026. No exploitation in the wild has been reported, and the issue is not listed in the CISA KEV.

Ratings are Critical: CVSS 9.8 and 9.3. The fixed versions are 4.18.9 and 5.11.2.

User Registration & Membership: arbitrary shortcode execution

Rule 406083 addresses WPSEC-2026-2711 in User Registration & Membership versions up to and including 5.3.1.

The ur_error and info query parameters can be used for unauthenticated arbitrary shortcode execution. Customers should update to 5.3.2.

WP Fastest Cache: authenticated path traversal

Rules 406084 and 406085 cover WPSEC-2026-2678 in WP Fastest Cache versions up to and including 1.5.4.

The issue can lead to arbitrary directory deletion. An authenticated user with the Author role or higher can use a percent-encoded post slug to leave the cache folder when the post cache is cleared. This vulnerability is not unauthenticated.

Version 1.5.5 contains the fix. The reported CVSS score is 8.1.

The Events Calendar: arbitrary shortcode execution

Rules 406086 and 406087 cover arbitrary shortcode execution in The Events Calendar. The BitNinja release lists versions 5.11.0 through 6.13.3. The matching public advisory, WPSEC-2026-2672, describes an unauthenticated issue through the calendar search keyword affecting versions 5.11.0 through 6.18.3.

The advisory lists CVSS 6.5. The fix is in 6.18.3.1.

No CVE was provided for this release. This issue should not be assigned CVE-2026-84740, which relates to a separate earlier shortcode vulnerability.

WP Data Access: privilege escalation

Rules 406088 and 406089 cover CVE-2026-118267 in WP Data Access versions up to and including 5.5.89.

The wpda/app/update, delete, and insert endpoints accept attacker-controlled key and val values without applying the app's row filter or column allow-list. This can let an attacker modify records outside the intended scope, including an administrator password hash.

The issue is unauthenticated when a published Data App allows anonymous writes. Otherwise, a Subscriber or higher account is required. Patchstack rates it CVSS 9.8 and lists it as known exploited in the Patchstack KEV. This is not a CISA KEV listing. Wordfence and Rapid7 rate it 8.1.

Version 5.5.90 fixes the issue.

Roundcube Webmail: authenticated IMAP command injection

Rule 410060 covers two Roundcube vulnerabilities in versions before 1.6.20 and 1.7.x before 1.7.5:

• CVE-2026-113386, involving the _uid parameter on mail/headers and mail/viewsource
• CVE-2026-114720, involving the _flag parameter on mail/mark

Both issues require an authenticated Roundcube session. They are fixed in 1.6.20 and 1.7.5.

Rules released on 9 November

Amelia Pro: unauthenticated time-based SQL injection

Rule 406081 covers CVE-2026-116751 in Amelia Pro 4.0 through 9.9.1.

The vulnerable keys of the tag[] array can carry SQL injection payloads. Magic quotes escape the values, but not the array keys, allowing unauthenticated time-based SQL injection.

Wordfence rates the issue CVSS 7.5. Patchstack lists it as known exploited in the Patchstack KEV. This is not a CISA KEV listing. The issue is fixed in 4.0 through 9.9.2, with customers needing to update to 9.9.2 or later.

LatePoint: unauthenticated account takeover

Rule 406079 covers CVE-2026-118066 in LatePoint versions up to and including 5.7.6.

The query builder treats the literal IS NOT NULL as SQL. An attacker can use this to expose a customer record, trigger a password reset, and overwrite the password, without authenticating. Wordfence rates the issue CVSS 9.1. Patchstack lists it as known exploited in the Patchstack KEV. This is not a CISA KEV listing.

Version 5.7.7 blocks the documented attack paths, while 5.7.8 completes the fix. Customers should update to 5.7.8 or later.

Coverage while customers update

SliceWP Affiliates, WP Data Access, Amelia Pro, and LatePoint are already exploited according to our data. Craft CMS has a public proof of concept, although no exploitation in the wild has been reported. Several of the remaining issues are unauthenticated, which makes exposed installations easier to target.

BitNinja WAF2 and WAF Pro customers are covered by the new rules on protected servers. The protection gives hosts time to reach customers who cannot update on disclosure day. Keep applying the vendor updates, since virtual patching does not replace upgrading the affected software.