Your WordPress Site Has a Hole in It. So Does Your Router. Here's What's Happening This Week.
There are two stories in this week’s intelligence feed that matter to UK small businesses. Not in the abstract, not eventually: right now, this week, for businesses running websites and office networks.
I’ll take them in order of immediate impact.
Story One: 600,000 WordPress Sites. One Plugin. No Login Required.
The Forminator Forms plugin, used by more than 600,000 active WordPress installations worldwide, has a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-15748.
Let me be precise about what that means. An attacker does not need a username. They do not need a password. They do not need to have any prior access to your website. If your site runs a vulnerable version of this plugin with certain form configurations enabled, an attacker can upload a malicious PHP file through the form and execute arbitrary code on your web server.
Arbitrary code execution on your web server means they own it. They can read your databases. They can exfiltrate customer data. They can install malware. They can use your server as a staging point for attacks on other systems. They can quietly sit there for months and do all of the above.
The patch exists. The question is whether your website has received it.
If you run a WordPress site for your business, here is what you need to do today. Log into your WordPress admin panel. Go to Plugins. Find Forminator Forms. Check the version. If it has not been updated in the last few days, update it now. If you pay someone to manage your website, call them today and ask them to confirm it has been patched.
This is not a complicated remediation. It is a plugin update. The failure mode here is not technical complexity. It is inaction.
Story Two: Your Router May Already Be Someone Else’s Infrastructure
Separately, researchers have documented a previously undescribed Linux botnet called Evooo1Bot. It is built on Mirai source code, which has been publicly available since 2016. That is not a coincidence: the authors chose it because it works, and because the vulnerabilities it exploits are still present on unpatched devices years after public disclosure.
Evooo1Bot scans the internet for routers and edge devices running vulnerable firmware. It exploits known flaws. The CVE list associated with this campaign includes vulnerabilities from 2024, 2023, 2022, 2021, 2020, 2019, 2018, and 2016. Some of these CVEs are nearly a decade old.
Once it compromises a device, it turns it into a SOCKS5 proxy. That means your router becomes a tunnel that criminals use to route their attack traffic through your network, your IP address, and your internet connection. To the outside world, the attack appears to originate from you. Your bandwidth is consumed. Your reputation is at risk. And you will almost certainly have no idea it is happening.
The botnet also performs SSH brute-force attacks, credential theft, and distributed denial-of-service operations from compromised devices.
The target is any unpatched Linux-based edge device: routers, NAS boxes, network cameras, anything sitting on the perimeter of your network that hasn’t been updated. Many small business networks have several of these. Most of them were set up by whoever installed the broadband, configured once, and never touched again.
Check your router. Log into the admin panel. The address is usually 192.168.0.1 or 192.168.1.1. Look for a firmware version number. Search that model and version number online and verify whether there is a newer version available. If there is, install it. If your ISP provided the router and you cannot update it yourself, call them and ask them to do it.
This is genuinely unglamorous security work. It is also genuinely effective.
What These Two Stories Have in Common
Neither of these attacks requires a sophisticated threat actor. Neither requires targeted reconnaissance against your business specifically. Both are the kind of opportunistic, automated, scan-and-exploit operations that run continuously across the entire internet.
Automated scanners find newly disclosed vulnerabilities within hours of public publication. They do not distinguish between a FTSE 100 company and a twelve-person accountancy firm in Coventry. If your system is exposed and unpatched, it will be found.
The defence in both cases is identical: keep your software current. That is it. That is the whole answer.
The barrier is not technical knowledge. The barrier is attention. Most small businesses have no systematic process for checking whether their web plugins are current, or whether their router firmware has been updated. They rely on whoever set things up to have done it correctly, and on things continuing to work the way they always have.
That assumption is being tested, continuously, by automated tools that do not take weekends off.
Why This Gives Your Business an Edge
Every client, prospect, or partner you deal with is in the same position. Most of them are also running unpatched software and forgotten infrastructure. The businesses that maintain basic hygiene: current software, patched firmware, regular checks, are genuinely differentiating themselves from the field.
If your business handles client data, processes payments, or operates any kind of web presence, being able to say with confidence that your systems are current and your perimeter is monitored is a commercial argument, not just a security one. It belongs in tender responses, client due diligence packs, and supplier questionnaires.
Cyber Essentials certification requires, among other things, that software is kept up to date and that network boundaries are properly controlled. The two vulnerabilities described in this brief are precisely the kind of issues that certification is designed to catch. If you hold Cyber Essentials and your processes are working, you should already have caught both.
If you do not hold Cyber Essentials, these two stories illustrate why the process of working towards it has practical value, not just box-ticking value.
Making the Business Case
Three arguments that should land with any director or budget holder:
The cost of remediation is zero. Updating a WordPress plugin costs nothing. Updating router firmware costs nothing. The only resource required is time, and in both cases the time is measured in minutes. The cost of a breach, by contrast, includes ICO investigation, customer notification obligations under UK GDPR, reputational damage, and potential civil liability.
These are not hypothetical threats. CVE-2026-15748 affects 600,000 active installations. Evooo1Bot is documented by researchers and actively scanning. These are not theoretical vulnerabilities awaiting exploitation; they are being actively targeted. The CISA KEV (Known Exploited Vulnerabilities) list exists precisely to separate theoretical risk from confirmed active exploitation.
Regulators will ask. The ICO’s enforcement posture on data breaches increasingly focuses on whether basic, reasonable security measures were in place. An organisation breached through an unpatched, publicly disclosed vulnerability, with a patch available, is in a difficult position when explaining to the regulator why it was not applied.
What to Do Before Friday
1. Audit your WordPress plugins today. Log into every WordPress site your business operates. Check the Plugins section. Update anything that has not been updated recently, and specifically verify that Forminator Forms is on its current version. If you pay a web agency or developer to manage your site, call them today.
2. Check your router and edge device firmware. Log into your router admin panel. Identify the model and current firmware version. Check the manufacturer’s website for a newer version. Apply it. If your router is more than five years old and no longer receives firmware updates from the manufacturer, it is a liability and should be replaced.
3. Make a list of your perimeter devices. Write down every device that sits between your network and the internet: routers, switches, firewalls, network-attached storage, security cameras. For each one, note the manufacturer, model, and when it was last updated. If you cannot answer those questions, you cannot assess your exposure.
4. Set a quarterly reminder. Neither of these checks requires specialist knowledge. They require discipline. A calendar reminder every three months to review plugin versions and firmware versions across your infrastructure will catch the majority of issues before they become incidents.
5. Verify with whoever manages your IT. If you have an MSP or IT provider, forward this article and ask them to confirm that both issues have been addressed across your estate. A competent provider should be able to answer that question the same day. If they cannot, that tells you something about the level of visibility they actually have over your systems.
Before you go: follow the show wherever you listen, and if this has been useful, please leave a rating or a review. It genuinely helps other small business owners find the podcast. Drop a comment if you have questions about anything covered here, and share it with someone who could do with a nudge to check their router firmware this week.