Your Router Is the Front Door: Three Vulnerabilities That Should Worry Every UK Small Business
Three sets of vulnerability disclosures landed in the last 24 hours. All critical. All with exploit code already in the public domain. That last fact is what changes the calculus for small businesses.
When an exploit is theoretical, you have time to plan. When the exploit is already available for download, the window closes fast.
Let’s go through what actually matters here, strip out the noise, and land on what you need to do.
The Edimax Router Flaws: Your Internet Connection May Already Be a Liability
Two vulnerabilities affecting the Edimax EW-7478APC router were published on 16 August 2026. Both score 9.9 on the CVSS scale. That is not a rounding error. It is as close to the maximum severity score as a vulnerability gets.
CVE-2026-19959 affects the WAN TCP/IP configuration function. An attacker who sends a crafted request can trigger a stack-based buffer overflow remotely, without needing to be on your network. CVE-2026-19961 hits the wireless site survey function with the same class of attack: a malformed input causes a buffer overflow that can lead to code execution.
Both exploits are publicly available. The vendor was contacted before disclosure and did not respond.
That last detail is important. When a vendor ignores a responsible disclosure, the researcher publishes anyway because silence is not security. The result: the exploit is now in the wild, patches are not, and anyone running this hardware is exposed.
If you or your MSP uses an Edimax EW-7478APC, the immediate question is: what is the compensating control while you wait for a patch that may not come? A router whose vendor ignores critical vulnerability reports is a router you should be planning to replace.
What to do: Check your router model. If it is an Edimax EW-7478APC, contact your MSP today and ask specifically about these CVEs. If they have not heard of them, that tells you something about their threat intelligence process. Consider replacing the device with a model from a vendor that has a credible patching track record.
WordPress: Two Plugin Vulnerabilities, Both Critical, Both Exploitable Without Login
WordPress remains the most attacked content management platform in the world. The reason is simple: it powers roughly 40% of all websites, and the plugin ecosystem is vast, inconsistently maintained, and frequently targeted.
Two vulnerabilities published this week illustrate the problem cleanly.
CVE-2026-16098 affects the ProSolution WP Client plugin, versions up to and including 2.0.10. The flaw is in the file upload function. An attacker who is not logged in can upload a file to your server, bypass the extension checks designed to block executable files, and achieve remote code execution. The plugin’s validation logic checks the file extension after the file has already been written to disk. By that point, the file is there and the damage is done.
CVE-2026-18432 affects the Frontend Admin by DynamiApps plugin, versions up to and including 3.29.9. This one involves privilege escalation. The plugin has an unauthenticated AJAX endpoint that is supposed to check whether the current user has permission to edit another user. However, passing a non-numeric string as the user ID causes the permission check to be skipped entirely. An attacker can pass a crafted value such as 1one and bypass the authorisation gate, escalating their access to administrator level on your site.
Administrator access on a WordPress site means full control: creating new admin accounts, installing malicious plugins, exfiltrating customer data, redirecting your site to distribute malware to your visitors.
If your business website runs WordPress, these are not abstract concerns.
What to do: Log into your WordPress admin panel. Go to Plugins. Check whether ProSolution WP Client or Frontend Admin by DynamiApps appear in your plugin list. If they do, check the installed version against the affected versions listed above. Update immediately. If updates are not yet available, deactivate the plugins until a patched version is released. If your website is managed by a third party, send them a message today asking for confirmation that these have been addressed.
VMware vCenter: The Infrastructure Your MSP Runs
CVE-2026-59310 is a critical directory-traversal vulnerability in the VMware vCenter Server Syslog component. Broadcom published the disclosure on 16 August 2026.
This one requires a small explanation for those without a technical background. vCenter is the management platform that sits above VMware’s virtualisation infrastructure. If your MSP runs virtual servers on your behalf, there is a reasonable chance vCenter is part of their stack. A directory-traversal vulnerability means an attacker can send a crafted request that causes the server to read files outside the directories it is supposed to access, potentially including configuration files, credentials, or data that should be restricted.
You are unlikely to be running vCenter yourself. But your managed service provider might be. And if their vCenter instance is compromised, the attackers are on the platform that manages your virtual infrastructure.
What to do: If you use a managed service provider, send them a specific question: are you running VMware vCenter, and have you applied the patch for CVE-2026-59310? Ask for confirmation in writing. A competent MSP will have a patch schedule and will be able to tell you. If they cannot answer the question, escalate it.
How to Turn This Into a Competitive Advantage
The businesses that treat vulnerability intelligence as background noise will have a bad week at some point this year. The businesses that act on it will not.
Being able to tell a client or prospective customer that you monitor critical vulnerability disclosures, maintain a patching schedule, and ask your technology providers for patch confirmation in writing is a differentiator. It is evidence that your security posture is active, not passive.
If you are in a sector where clients ask about your cyber security practices during procurement, this is the kind of operational detail that distinguishes genuine security from paperwork.
How to Sell This to Your Board
Three points worth making in any board or budget conversation this week.
First: exploit availability changes the timeline. CVSS scores are a severity measure, not a timeline measure. When an exploit is publicly available, the question is no longer whether attackers can use it, but whether they already are. The three vulnerability sets covered today all have public exploits. This is not a 30-day patching window. It is a this-week problem.
Second: your attack surface includes your suppliers. If your MSP runs unpatched VMware infrastructure, your data is exposed through their systems. Supply chain risk is not abstract. It is your client data on someone else’s unpatched server.
Third: the cost of checking is low. Asking your MSP for patch confirmation costs nothing. Checking your WordPress plugin versions takes five minutes. Replacing an end-of-support router is a few hundred pounds. The alternative is a breach investigation, an ICO notification, and an explanation to your clients about why their data was accessible to an attacker who used a publicly documented technique.
What to Do Before the End of This Week
-
Check your router model. If it is an Edimax EW-7478APC, contact your MSP or supplier today. Ask specifically about CVE-2026-19959 and CVE-2026-19961. If firmware patches are not available, begin the process of replacing the device.
-
Check your WordPress plugins. Log in, go to the Plugins section, and look for ProSolution WP Client and Frontend Admin by DynamiApps. Update to patched versions immediately. If your site is managed externally, ask for written confirmation that this has been done.
-
Ask your MSP about vCenter. Send a direct message asking whether they run VMware vCenter and whether CVE-2026-59310 has been patched. Record the response. If they cannot answer, that is a risk your board should know about.
-
Review your patching policy. If your current approach to software updates is broadly “when we get around to it,” today is a useful reminder of what that posture costs. A documented patching schedule, with defined response times for critical severity vulnerabilities, is not governance theatre. It is the difference between catching these disclosures in time and reading about them after an incident.
-
Document what you did. If you are ever subject to an ICO inquiry following a breach, demonstrating that you acted on credible threat intelligence within a reasonable timeframe is relevant to the assessment of whether you took appropriate technical measures under UK GDPR Article 32. Write down what you checked, what you found, and what you did.
Before you go: follow the show wherever you listen, leave a rating or review, and drop a comment with your thoughts. If you found this useful, share it with someone who would benefit from hearing it. The more people act on this kind of intelligence, the harder it gets for the attackers.