Your Router Is a Liability, Your WordPress Site Is a Target: UK Small Business Threat Brief, 13th October 2026
Three items landed in the vulnerability feeds overnight that collectively tell a coherent and uncomfortable story about the current threat environment for UK small businesses. None of them require nation-state resources to exploit. All of them have public exploit code already circulating. Two of them involve vendors who have effectively told their customers to sort it out themselves.
This is the brief for the 13th of October 2026. Pick the item most relevant to your setup and act on it today.
Story One: Your Office Router May Have a CVSS 10.0 Flaw With No Patch Coming
The most significant cluster of vulnerabilities published in the last 24 hours all share a profile: consumer and small business grade routers, CVSS scores of 10.0, exploit code already public, and vendors who are either silent or have formally confirmed end-of-life status.
The affected hardware includes TRENDnet TEW-751DR, TEW-752DRU, and TEW-733GR (CVE-2026-108804), multiple Linksys E1700 models across several CVEs including CVE-2026-108892, CVE-2026-108893, CVE-2026-108894, CVE-2026-108895, CVE-2026-108896, and multiple Edimax BR-6208AC vulnerabilities including CVE-2026-108917, CVE-2026-108918, CVE-2026-108914, and CVE-2026-108915. There are also two Netcore NR268 flaws: CVE-2026-108907 and CVE-2026-108929.
The vulnerability classes are serious: OS command injection, stack-based buffer overflow, and improper authentication. In plain terms, these are flaws that allow an attacker to run arbitrary commands on your router from the internet, or to bypass authentication entirely without needing credentials.
The vendor responses are instructive. TRENDnet’s statement in the CVE advisory is worth quoting directly: “As this router was EOL’d in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product.” Hardware end-of-lifed in 2011 is still sitting in networks in 2026. Edimax and Netcore did not respond to disclosure contact at all.
Linksys at least received the disclosure reports, though its responses are not documented in the NVD advisories.
Why this matters for UK small businesses: Consumer routers end up in small business networks constantly. An MSP or IT supplier sets up a site five years ago, uses whatever router was available, and that hardware quietly ages out of vendor support without anyone noticing. The device keeps routing traffic. Nobody checks whether it’s still receiving updates. This is not a hypothetical. The Cyber Security Breaches Survey consistently identifies unpatched and out-of-support devices as a contributing factor in incidents affecting UK SMBs.
An attacker who can execute commands on your router can redirect your DNS (sending your staff to fake login pages), intercept traffic, pivot into the rest of your network, or deploy persistent backdoors. This is not a low-skill operation: it is a low-effort one, particularly when exploit code is already public.
What to check: Log into your router’s admin panel and find the model number. Search it on the vendor’s website alongside the word “support” or “end of life”. If the vendor confirms EOL status and there is no patch available for these CVEs, the device needs to be replaced, not managed around.
If you cannot log in because you don’t know the credentials, that is a separate problem that also needs addressing immediately: default credentials are one of the most commonly exploited attack vectors on SMB network devices.
Story Two: The Bricksforge WordPress Plugin Is Under Active Exploitation Right Now
If you run a WordPress site for your business, this is your most time-sensitive item today.
CVE-2026-85097 is a CVSS 10.0 vulnerability in the Bricksforge plugin for WordPress. It is under active exploitation in the wild, confirmed by Patchstack. The flaw enables unauthenticated PHP code execution: an attacker who knows your site runs a vulnerable version of Bricksforge does not need a username, a password, or any prior access. They can execute arbitrary PHP directly on your web server.
The consequences of that are not abstract. An attacker with code execution on your WordPress server can: exfiltrate your customer database, install web shells for persistent access, redirect your visitors to malicious pages, use your site as part of a phishing or malware distribution infrastructure, and extract any credentials stored in your WordPress configuration, including database passwords.
For a small business, a compromised website is not just a technical problem. It is a data protection incident under UK GDPR, potentially reportable to the ICO within 72 hours if personal data has been accessed. It is a reputational incident. It is an incident that can directly affect customer trust and contractual relationships.
What to check immediately: Log into your WordPress admin dashboard and navigate to Plugins. If Bricksforge is installed, check the version number against the latest available in the plugin repository and update it immediately. If automatic updates are not enabled for plugins, enable them.
More broadly, review every plugin installed on your WordPress site. Uninstall anything you are not actively using. This is not a one-off task: WordPress plugin security requires ongoing attention because the plugin ecosystem is large, fragmented, and frequently targeted.
If your WordPress site is managed by an agency or MSP, contact them today and ask specifically whether Bricksforge is installed and whether it has been patched. Do not assume they are monitoring this proactively.
Story Three: SonicWall SMA 1000 SSRF Flaw Under Active Attack
CVE-2026-102255 is a maximum-severity server-side request forgery (SSRF) vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances. According to reporting from both The Hacker News and Dark Reading, attackers made 135 documented exploitation attempts against this flaw in the days following public disclosure, originating from two US-based IP addresses.
SSRF, in plain terms, means an attacker can cause the affected device to make network requests on their behalf. In a remote access appliance sitting at the edge of your network, that capability is particularly damaging: the appliance is trusted by the internal network, so requests it makes may bypass internal firewall rules. Depending on configuration, this can be a path to internal network access from the internet.
The patch exists. SonicWall has released it. The problem is the gap between patch availability and patch deployment, which in practice is often measured in weeks or months rather than hours. The 135 exploitation attempts documented here happened within days of disclosure. Attackers are not waiting.
SonicWall appliances appear in UK SMB networks most commonly in businesses with a distributed workforce or multiple sites that need secure remote access. If you or your IT provider deployed SonicWall kit for remote working during and after the pandemic, this is worth checking.
What to check: Ask your IT provider or MSP whether your network includes a SonicWall SMA 1000 appliance. If it does, confirm it has been patched for CVE-2026-102255. If it has not, ask when that will happen. “We’ll get to it” is not an acceptable answer when exploit attempts are already being documented in the wild.
The Pattern Underneath All Three Stories
These three items look superficially different: legacy consumer hardware, a WordPress plugin, an enterprise remote access appliance. But they share an underlying dynamic that is worth naming.
In each case, working exploit code is already public. In each case, vendors have either confirmed they will not patch (legacy routers), released a patch that has not been widely applied (SonicWall), or patched a flaw that was already being exploited before most administrators had a chance to respond (Bricksforge). The gap between vulnerability disclosure and active exploitation has compressed significantly. The Hacker News weekly recap notes explicitly that some flaws are now being tested “within hours” of disclosure.
For UK small businesses, the implication is operational rather than theoretical. Waiting for your quarterly IT review to apply patches is not a viable posture when the exploitation window is measured in days. The same logic applies to hardware lifecycle management: a device that fell off vendor support in 2011 has had fifteen years to accumulate unpatched vulnerabilities. The fact that it was still routing traffic last week does not mean it is safe.
This is not an argument for panic or for expensive security products. It is an argument for knowing what is in your network, knowing whether it is still supported, and having a relationship with whoever manages your IT that allows you to ask these questions and get straight answers.
How This Gives You a Competitive Edge
Three of your competitors are running unpatched routers right now. Several are managing WordPress sites with out-of-date plugins. Some are using remote access appliances that haven’t been updated since the patch landed.
Buyers, particularly in B2B markets, are increasingly asking about security practices during procurement. Being able to demonstrate that your network kit is within vendor support, that your website is actively maintained, and that your remote access is patched current is a differentiator that costs nothing to state once you have done the work to make it true.
Cyber Essentials certification, which requires that devices be patched and supported, provides an independently verified way to communicate this posture. It also blocks a substantial proportion of commodity attacks of precisely the kind described above. If you do not hold it, the question is worth asking: what is the barrier, and is it real?
Making the Business Case
Three arguments that translate this brief into board-level language.
Unpatched and end-of-life devices are a known liability. The ICO has referenced failure to patch as a factor in data protection enforcement actions. If personal data is exfiltrated through a device that was past vendor support and unpatched, “we didn’t know” does not function as a defence.
The cost of replacement is bounded; the cost of a breach is not. A replacement small business router costs between £100 and £300. An incident involving customer data exfiltration, site downtime, and ICO reporting obligations costs significantly more in staff time alone, before any financial penalty is considered.
Your MSP or IT provider has a duty to tell you this. If your provider has not flagged end-of-life hardware or unpatched plugins in recent communications, that is a gap in the service they are providing. It is a reasonable question to raise in your next review meeting, and the answer will tell you something useful about their monitoring practices.
What to Do This Week
-
Check your router’s support status today. Find the model number, visit the vendor website, and confirm whether security updates are still being issued. If the answer is no, raise replacement as a priority with your IT provider. Do not wait for the next scheduled review.
-
Log into your WordPress admin and audit your plugins. Specifically check for Bricksforge and patch it immediately if it is present. As a general measure, remove any plugins that are not actively in use and enable automatic updates for those that remain.
-
Ask your IT provider or MSP directly whether you use SonicWall SMA 1000 appliances, and if so, whether CVE-2026-102255 has been patched. The question should take five minutes to answer. If it takes longer, that is worth noting.
-
Establish a hardware lifecycle register. This does not need to be sophisticated: a spreadsheet listing every piece of network equipment, its vendor, model, and end-of-support date is sufficient. If you do not know what is in your network, you cannot manage it.
-
Review your ICO breach reporting obligations. If you run a WordPress site that holds customer data and it were compromised via a vulnerability like CVE-2026-85097, you would likely have a 72-hour reporting obligation. Knowing the process before an incident occurs is significantly less stressful than discovering it during one.
If you found this brief useful, follow the show on your podcast platform of choice, leave a rating or review if you have a moment, drop a comment with your thoughts or questions, and share it with a business owner who you think needs to hear it. It genuinely helps.