WAF Watch: A CVSS 10 WordPress upload flaw, Ninja Forms hidden admins, a Drupal advisory pile-up

(opens in a new tab)Mac Clark (opens in a new tab) · October 12, 2026

A short roundup of what hit websites this past week, and what to do about it if you run campus or agency sites.

ProtectMyWebsite is the WAF that tells you what’s safe to block: rules start in count, then your dashboard shows what to promote. You still decide.

1. Bricksforge — unauthenticated PHP upload, exploited within days (CVE-2026-85097)

Patchstack reported active exploitation of CVE-2026-85097 in Bricksforge, an add-on for the Bricks site builder on WordPress. It’s an unauthenticated arbitrary file upload rated CVSS 10.0: anyone can upload and run PHP on an unpatched site. Versions through 3.1.8.9 are affected; 3.1.8.10 fixes it. Patchstack first saw attacks on October 7, including one cluster of 44 IPs firing identical payloads within seconds and another probing 25 variations of PHP extensions and encodings.

The same week, WordPress shipped 7.1.3 (October 6), a maintenance and security release with seven security fixes, among them a stored XSS in the Comments admin and a second-order SQL injection in WXR export. WordPress.org says to update immediately.

Campus angle: page-builder add-ons tend to show up on marketing, admissions, and event microsites that a vendor or student worker built and nobody has touched since.

Do this: Search every WordPress install for Bricksforge and update to 3.1.8.10 or later. Update core to 7.1.3. If a site ran a vulnerable Bricksforge version after October 7, look for new .php files in wp-content/uploads and treat any you find as a compromise, not a cleanup.

Patchstack · The Hacker News (Oct 12) · WordPress 7.1.3 release (Oct 6)

2. Ninja Forms — a form submission that installs a hidden admin when staff read it

Patchstack also caught a campaign abusing two stored-XSS bugs: CVE-2026-94504 in Ninja Forms (through 3.15.3, roughly 500,000 installs) and CVE-2026-93836 in WPC Product Bundles for WooCommerce (through 8.6.6). An anonymous visitor submits a form entry or order containing a script. When a logged-in administrator opens that submission, the script runs in their session, installs a fake plugin called WP Smart Thumbnails, and sets up four ways back in: a visible admin account, a hidden admin that doesn’t appear on the Users screen, a secret login link, and a file manager with no login. Parts of it live in mu-plugins and are backdated, so removing the fake plugin isn’t enough. Patchstack says volume is limited so far.

Campus angle: Ninja Forms is everywhere on campus and agency WordPress — contact forms, event RSVPs, records requests. The person who triggers this attack is the staffer doing their job and reading submissions.

Do this: Update Ninja Forms to 3.15.4+ and WPC Product Bundles to 8.6.7+. Updating stops new infections but doesn’t remove an existing one, so check for a wp-smart-thumbnails plugin, unexpected files in mu-plugins, and administrator accounts in the database that the dashboard doesn’t show. Search logs for _wplogin= on wp-login.php and requests to imgcdn1.com. If anything turns up, rotate every admin password and the auth salts.

BleepingComputer · ThaiCERT summary (Oct 8)

3. Drupal — 26 contrib advisories in one day, one highly critical

On October 7 the Drupal Security Team published 26 contributed-module advisories across 25 projects: one highly critical, seven critical, 17 moderately critical, and one less critical. The headline is Block AJAX (SA-CONTRIB-2026-192, CVE-2026-107249), a PHP object injection that can lead to remote code execution on sites with Layout Builder enabled; update to 3.0.2, and read its release notes because the fix changes which blocks the route will load. Two others stand out for our readers: MathJax (SA-CONTRIB-2026-195, critical XSS, update to 4.1.2 and check the status report for a “safe mode is not enabled” warning) and DKAN, the open-data portal module many governments run (SA-CONTRIB-2026-208, access bypass, update to 4.1.5 or 4.0.4). Drupal core had no new advisory this week.

Campus/agency angle: MathJax is a math-and-science department staple, and DKAN powers public open-data portals. Several of these fixes also need a config change, database update, or cache clear after the package update, so “composer updated” isn’t the same as “fixed.”

Do this: Run drush pm:security (or check Available updates) on every Drupal site, including the multisite children. Prioritize Block AJAX on any site with Layout Builder, then MathJax and DKAN. Read each advisory’s follow-up steps before you mark it done.

Drupal SA-CONTRIB-2026-192 · SA-CONTRIB-2026-195 · SA-CONTRIB-2026-208 · The DropTimes roundup (Oct 9)

4. Osaka Metropolitan University — when ransomware takes the website down with everything else

Osaka Metropolitan University said a failure that began on October 2 in its virtualization infrastructure was ransomware. About 500 servers went down at once, and the outage took out the campus network, university email, the official websites, learning and academic-affairs systems, finance, payroll, and the library. Much of the backup data was encrypted too. Classes were cancelled through October 8, and the university is investigating whether personal data on at least 130,000 students, graduates, and staff left the building. With its own site down, OMU stood up a temporary announcement site on a separate domain to reach students and applicants. Istanbul’s Yıldız Technical University reported a similar ransomware hit to its virtualization layer on October 1, with about 140,000 students and 4,500 staff potentially affected.

Campus angle: neither of these was a website exploit, but in both the public website was a casualty. If your homepage, news site, and status page all live in the same data center as your ERP, a ransomware event leaves you with no way to talk to students.

Do this: Keep a pre-approved emergency announcement page ready on hosting that shares nothing with campus infrastructure, and decide now who can publish to it and which domain it lives on. Make sure your comms team knows the URL without needing email to look it up.

OMU temporary announcement site · The Cyber Express (Oct 7) · ThreatTicker on Yıldız (Oct 7)

Tip of the week

The inputs your staff read are attack surface. Watch them before you block.

The Ninja Forms campaign didn’t break in through a login page. It came in through a form field and waited for an admin to look at it. The Drupal Block AJAX bug also starts with user-supplied data on a public route. Edge rules that catch script payloads in form submissions, or odd serialized data on AJAX block routes, are exactly the kind of virtual patch that buys time, and exactly the kind that can trip over a legitimate rich-text field or a theme that does something unusual.

Patch the plugin or module first.
Add a narrow rule for the request shape: script tags in form-submission bodies, or unexpected parameters on the affected route.
Leave it in count against real traffic.
After about a day, open the dashboard — it shows what’s safe to block.
One click to promote. You stay in the loop.

That’s how ProtectMyWebsite works: Rules start in count. After 24 hours, the dashboard shows what’s safe to block — one click. The WAF Cybersecurity Advisor is rule-based: it reads your count window and explains in plain English why a rule looks safe to promote, or why to hold it or allowlist something. It never blocks on its own; you click.

Self-serve is $150/site/month with a 14-day trial. Refer a peer and you both get 10% off for three months.

Running a multi-site estate (main site, departmental WordPress and Drupal, portals)? Ask about Campus Estate: Talk to sales team.

If you run campus or agency sites: scan your site, see what WAF count mode is, what’s safe to block on a WAF, WAF for higher education, WAF for government, the blog, Prior Watch (Oct 5), and start a 14-day trial.