WAF Watch: WordPress core’s upgrade-window RCE hits CISA’s exploited list, a booking plugin account takeover, and a legacy portal opens the door at TU Munich

(opens in a new tab)Mac Clark (opens in a new tab) · November 9, 2026

A short roundup of what hit websites this past week, and what to do about it if you run campus or agency sites.

ProtectMyWebsite is the WAF that tells you what’s safe to block: rules start in count, then your dashboard shows what to promote. You still decide.

1. WordPress core — the upgrade-window RCE is now on CISA’s exploited list

On November 3 CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. It’s a race condition in WordPress core, versions 4.7 through 7.1.3. During a full-package core update, WordPress unpacks a complete copy of itself, installer included, into a predictable folder under wp-content/upgrade/. An attacker with no account who requests that staged setup-config.php in the few seconds before cleanup can end up running code on your server.

The window is short, but it reopens on every update, including unattended ones. Wordfence reported more than 18,500 requests aimed at staged installer paths in the first 21 hours after disclosure. Patchstack points out the catch: the staged copy boots from its own files, so a security plugin inside the live site never runs for that request. It has to be stopped in front of PHP. Federal civilian agencies had until November 6 to remediate.

The fix is 7.1.4 (released October 28), with backports for every branch down to 4.7.39. Sites on 4.6 or older get nothing. And the update to 7.1.4 still runs the old unpacking code, so it can open the window one last time.

Do this: Deny web access to /wp-content/upgrade/ first (WordPress only touches that folder on disk, so updates keep working), confirm a request returns 403, then update. On sites that sat unpatched, look for requests to PHP files under wp-content/upgrade/, admin accounts nobody recognizes, and plugins nobody installed.

CISA KEV alert (Nov 3) · WordPress 7.1.4 · Patchstack analysis · The Hacker News

2. Exploited WordPress plugins — a booking plugin takeover, and one with no patch at all

Three plugin flaws were flagged as exploited this week:

LatePoint (appointment booking, 100,000+ active installs), CVE-2026-118066: an unauthenticated request to the public customer password-change flow can overwrite a customer’s password and take over the account. If LatePoint is set to use WordPress users as customers, the linked WordPress account goes too. Patchstack lists it as exploited. Fixed in 5.7.7; 5.7.8 is current.
WP Duplicate (formerly LocalSync), CVE-2026-123751: WPScan reported on November 9 that an authentication bypass is being used to upload arbitrary files and run code. All versions through 1.1.11 are affected and there is no fix. It’s a small plugin, around 200 installs, but every exposed site is fully exposed.
ACF Extended PRO, CVE-2026-120534: unauthenticated code execution through front-end forms with Dynamic Render fields, under specific (non-default) conditions. Patchstack added it to its exploited list on November 3. Fixed in 0.9.2.7; move to 0.9.2.8.

Campus/agency angle: booking plugins sit behind advising appointments, recreation centers, tutoring, and permit offices. They’re public by design, and they’re usually installed by a department, not central IT.

Do this: Search the fleet for LatePoint, WP Duplicate (or LocalSync), and ACF Extended PRO. Update LatePoint and ACF Extended PRO; remove WP Duplicate outright. For LatePoint, force password resets on customer accounts and review recent password-reset activity.

LatePoint writeup (WPdeeply) · WP Duplicate (SecurityOnline) · ACF Extended PRO (WPdeeply)

3. Drupal — 24 more contrib advisories, and shorter support for minor versions

On November 4 the Drupal Security Team published 24 contributed-module advisories, right after October’s record month. Core wasn’t affected. The ones to check first:

REST & JSON API Authentication (SA-CONTRIB-2026-298, Critical): if API authentication is on but no API key was ever generated, unauthenticated requests get through. Fixed in 3.2.1. If you can’t update today, generate a key.
Content Synchronizer (SA-CONTRIB-2026-293, Critical): a crafted import archive leads to code execution. Fixed in 4.1.1. That’s the second content-import module with this bug in a week.
Two payment webhooks that could mark unpaid orders as paid: Commerce Escrow (SA-CONTRIB-2026-302) and AlternativeCommerce PayPal Checkout (SA-CONTRIB-2026-300). Update, then reconcile recent "paid" orders against the processor.
GroupEx PRO (Daxko), marked unsupported on October 28, got a fix (2.2.1) and was restored.

Separately, PSA-2026-11-02 says that starting in 2027, Drupal minor versions get 8 months of security coverage instead of 12, because the Security Team is swamped by AI-assisted reports. Drupal 11.3 is supported until December 2026, 11.4 until April 2027. Drupal 10 still ends in December 2026.

Do this: composer outdated "drupal/*" on every site and multisite child. Then put minor-version upgrades on a twice-a-year calendar; the old once-a-year rhythm won’t keep you covered.

SA-CONTRIB-2026-298 · PSA-2026-11-02 · Drupal security advisories · RescuePHP roundup

4. TU Munich — a legacy portal leads to the campus management system

On November 6 the Technical University of Munich disclosed that attackers got into its legacy myTUM portal and reached users’ passwords, names, home addresses, and dates of birth; for students, also ID numbers, degree programs, and semesters. All myTUM accounts are potentially affected, and TUM hasn’t said how the passwords were stored. Among the stolen credentials was a system administrator’s login for TUMonline, the central campus management system, which the attackers then went after. TUM took TUMonline offline, disabled the stolen credentials, and says its logs show no grades or applications were taken. It came back on November 9 so users could change passwords. TUM’s note on MFA is the line to remember: accounts with MFA were protected.

Meanwhile Leipzig University, offline since October 28, said on November 5 that analysis is still under way, and its rector has warned it will take weeks to bring everything back.

Campus angle: the old portal nobody retired was the way in, and an admin password was the way across.

Do this: List the legacy portals and "we’ll decommission it next year" apps still answering on your campus domains. Put them behind SSO and MFA, or take them down. Require MFA on every admin account for your student and campus management systems.

TUM notice · heise online (Nov 6) · The Register (Nov 9) · Leipzig University update (Nov 5)

Tip of the week

Some paths have no public purpose. Find them, count them, then block them.

/wp-content/upgrade/ is the cleanest example you’ll get: nobody outside your server should ever request it, and the attack against it runs before your WordPress security plugin loads. That’s exactly what an edge rule is for.

Add a narrow rule matching requests under /wp-content/upgrade/ (and the same path under any subfolder installs, like /blog/wp-content/upgrade/).
Leave it in count across the fleet and see what hits it. You should see scanners and nothing legitimate.
After about a day, open the dashboard — it shows what’s safe to block.
One click to promote. Then patch to 7.1.4.
Test it twice: once through the edge, and once against the origin directly. An edge rule doesn’t help if the origin answers the internet on its own.

The same pattern fits LatePoint’s password-reset endpoints while you patch, and the import routes on Drupal content-sync modules nobody outside your team should be calling.

That’s how ProtectMyWebsite works: Rules start in count. After 24 hours, the dashboard shows what’s safe to block — one click. The WAF Cybersecurity Advisor is rule-based: it reads your count window and explains in plain English why a rule looks safe to promote, or why to hold it or allowlist something. It never blocks on its own; you click.

Self-serve is $150/site/month with a 14-day trial. Refer a peer and you both get 10% off for three months.

Running a multi-site estate (main site, departmental WordPress and Drupal, portals)? Ask about Campus Estate and talk to our sales team.

If you run campus or agency sites: scan your site, see what WAF count mode is, what’s safe to block on a WAF, WAF for higher education, WAF for government, the blog, Prior Watch (Nov 2), and start a 14-day trial.