4 WAF Rules for Critical WordPress & Joomla Vulnerabilities

Yet another day, yet another critical RCE vulnerability.

It really feels like server/website owners can't catch a break from these vulnerabilities anymore. Thankfully BitNinja has your back this time too. The rules are rolled out to all default WAF rulesets. Despite this protection in place, it still is recommended to update the affected plugins to their respective patched versions.

UpdraftPlus turns a backup connection into a takeover path

UpdraftPlus is installed on more than 3 million WordPress sites. Its UpdraftCentral integration lets site owners manage backups remotely, but a flaw in that connection can allow an unauthenticated attacker to forge an RPC request.

The vulnerability, tracked as CVE-2026-10795, affects the free version through 1.26.4 and the premium version before 2.26.5 on sites that were ever connected to UpdraftCentral.

The vulnerable code accepts a forged message with format=1 and does not properly handle a failed RSA decryption. That failure results in a predictable all-zero AES key and initialization vector. An attacker can then send RPC commands as the connected administrator.

Those commands can include uploading and activating a malicious plugin. That gives the attacker a path to remote code execution and full control of the WordPress site. Public proof-of-concept code and testing labs are already available, which increases the risk of automated, large-scale attacks.

UpdraftPlus fixed the issue in version 1.26.5 for the free plugin and version 2.26.5 for the premium plugin.

BitNinja rule 406071 helps block exploitation attempts while site owners apply those updates.

Three additional unauthenticated vulnerabilities

The new rule set also covers three other critical issues affecting WordPress and Joomla extensions:

• Rule 406072, CVE-2026-116512: Unauthenticated function injection through the id parameter in the weDevs Project Manager WordPress plugin through version 4.1.1.
• Rule 410058, CVE-2026-102427: Unauthenticated remote code execution through executable file uploads in OrdaSoft CCK for Joomla versions before 8.3.16.
• Rule 410059, CVE-2026-101110: Unauthenticated ORDER BY SQL injection in OrdaSoft Book Library for Joomla versions before 6.4.6.

Why this matters to hosting providers

Hosting providers and server owners may manage thousands of CMS installations without controlling the update process on each site. Customers can delay plugin updates, and backup plugins such as UpdraftPlus are common across shared hosting environments.

When proof-of-concept attacks are public, attackers can scan for vulnerable installations and target unpatched sites at scale. A server-level WAF gives providers a way to reduce that exposure across the server while customers update their extensions.

BitNinja has added the four protections to WAF2 and WAFPro. The rules inspect traffic for attempts to exploit the listed vulnerabilities and block matching requests automatically.

Recommended actions

BitNinja users are protected, although its important to note that the full remediation is still updating the affected plugins.

The recommended course of action is as follows (in order of priority)

1. Update UpdraftPlus to 1.26.5 or 2.26.5, depending on the installed edition.
2. Update weDevs Project Manager beyond 4.1.1.
3. Update OrdaSoft CCK to 8.3.16 or later.
4. Update OrdaSoft Book Library to 6.4.6 or later.
5. Check for unknown plugins, unexpected administrator accounts, and other signs of compromise.

As a safety precaution, hosting providers should keep the new BitNinja WAF2 or WAFPro rules enabled, then continue monitoring affected sites as customers complete their updates.