Your WordPress Site and Your Router Are Under Active Attack Right Now
Two critical vulnerabilities landed in the National Vulnerability Database this week. Both score at the top of the severity scale. Both have public exploits already circulating. And both affect technology that sits inside UK small businesses every day: a popular budget router and a widely-used WordPress plugin.
This is not vendor fear-mongering. The data is in the NVD. The scores are independently calculated. The exploits are confirmed as public. What follows is what the numbers actually mean for a business running between five and fifty people.
The Router with a Perfect 10
On the 2nd of November 2026, NIST published CVE-2026-120345, assigned a CVSS score of 10.0. That is not a typo. A perfect score. The vulnerability sits in WAVLINK routers, specifically the WN551X3-A running firmware version M51X3_V251020-WO-182e965.
The flaw is in the DNS resolution handler: a function called sub_41a430 inside the file /bin/ioos. An attacker can manipulate the data argument to inject operating system commands. In plain terms: they send a crafted request to your router’s DNS handler, and the router executes whatever they tell it to.
No authentication required. No user interaction required. The attack is possible remotely, over the internet.
The vendor was notified before public disclosure. The exploit has been made public. That sequence matters: it means the vulnerability is known, the exploitation method is known, and any attacker with basic competence and a scanner can find and hit affected devices.
WAVLINK routers are not enterprise kit. They are sold to small offices and home offices, often by MSPs looking to keep hardware costs down. If your broadband router was supplied by your IT provider and you have never questioned the model, this is worth checking today.
What to check: Log into your router’s admin interface (usually at 192.168.1.1 or 192.168.0.1) and identify the model number. If it is a WAVLINK WN551X3-A, check the firmware version. Contact your supplier immediately and ask for a firmware update or a replacement device. If firmware is not available, consider isolating the device or replacing it with a supported model.
The WordPress Plugin That Hands Over Your Server
On the same day, NIST also published CVE-2026-102435, scored at 9.8. This one affects a WordPress plugin: Ultra Addons for Contact Form 7, in all versions up to and including 3.5.54.
Contact Form 7 is one of the most widely installed plugins in the WordPress ecosystem. Ultra Addons extends it with additional features, including a PDF Generator add-on. That PDF Generator is the critical component here.
The vulnerability lies in a function called _getObjAttr, which fails to validate file paths properly. An unauthenticated attacker, meaning someone with no account on your site whatsoever, can send a request that deletes arbitrary files from your server. The NVD advisory is direct about the consequence: deleting wp-config.php, WordPress’s core configuration file, can easily lead to remote code execution.
Why? Because wp-config.php contains your database credentials and security keys. When it is deleted, WordPress enters a reinstallation state. An attacker who triggers that state can then install a fresh WordPress instance connected to your existing database, effectively taking over your entire site and the data behind it.
Two conditions are required for this to work: the PDF Generator add-on must be active, and a Contact Form 7 form must be configured to generate PDFs. If your site uses Ultra Addons and you have ever set up a PDF-enabled form, you are potentially in scope.
What to do: Log into your WordPress dashboard now. Go to Plugins. If Ultra Addons for Contact Form 7 is installed, check the version. Version 3.5.54 and below are vulnerable. Update immediately if a patched version is available. If no update is available, deactivate the plugin. If you are unsure whether the PDF Generator add-on is active, deactivate the whole plugin as a precaution and ask your web developer to investigate. This is not a situation where waiting for a scheduled maintenance window is acceptable.
Why Small Businesses Are the Target, Not an Afterthought
There is a persistent and damaging belief in the SMB community that attackers go after large organisations. The logic goes: why bother with a ten-person accountancy firm when you could hit a bank?
The answer is that attackers do not choose targets the way a burglar chooses a house. They run automated scanners across millions of IP addresses. Those scanners do not filter by company size. When a CVSS 10.0 exploit for a consumer-grade router is public, every vulnerable device on the internet is a potential hit within hours of the advisory going live.
WAVLINK routers are cheap. They are common in small offices. A scanner looking for the specific fingerprint of a vulnerable WN551X3-A will find them regardless of whether they belong to a sole trader or a global logistics company.
WordPress powers an estimated 40% of websites on the internet. The proportion among small business sites is higher, not lower. A plugin with 9.8-severity file deletion and a public exploit chain will be probed within days, if not hours.
The ICO’s breach notification data consistently shows that small businesses report incidents involving website compromise and ransomware following initial access through exactly these kinds of publicly known vulnerabilities. The pattern is not new. The specific CVEs are.
How to Turn This Into a Competitive Advantage
Patching quickly is not just hygiene. It is a differentiator.
If you work in professional services, if you handle client data, if you are part of any supply chain, your clients are increasingly asking about your security posture. Being able to demonstrate that you have a documented process for monitoring and applying critical patches, and that you acted on CVE-2026-120345 and CVE-2026-102435 within 48 hours of publication, is a concrete, verifiable answer to that question.
It is also relevant to your Cyber Essentials certification. CE+ requires that critical and high-severity patches be applied within 14 days. A CVSS 10.0 and a CVSS 9.8 with public exploits are not edge cases: they are exactly the category CE+ has in mind. Acting now keeps you compliant. Waiting puts your certification at risk.
If your MSP manages your infrastructure and you have not received a notification from them about these CVEs already, that is information worth having. Ask them directly. Their response will tell you something useful about how they operate.
Making the Business Case
If you need to justify patching time or expenditure to a director or a board, here are three lines that will land:
First: the exploit is already public. This is not a theoretical risk with a future exploitation window. The method is known and circulating now. The cost of inaction compounds with every day that passes.
Second: website compromise has direct regulatory consequences. If your WordPress site is exploited and customer data is exfiltrated through a compromised database, that is a notifiable breach under UK GDPR. The ICO’s enforcement record on breach notification failures is not forgiving. The cost of a breach notification, let alone enforcement action, exceeds the cost of an emergency patching exercise by orders of magnitude.
Third: your insurance may not cover known vulnerabilities. Cyber insurance policies increasingly exclude claims arising from unpatched vulnerabilities that were publicly disclosed before the incident. CVE-2026-102435 was published on the 2nd of November 2026. If your policy has a patch window requirement and you are still running the vulnerable plugin in a week, your insurer will have grounds to push back on a claim.
What to Do This Week
1. Identify your router model today. If you have a WAVLINK WN551X3-A on your network, treat it as compromised until you have confirmed a firmware fix is available and applied it. If your IT provider cannot confirm this within 24 hours, escalate.
2. Audit your WordPress plugins. Log into every WordPress site your business runs. Check for Ultra Addons for Contact Form 7. If it is installed in any version up to 3.5.54, update or deactivate it immediately. Do not wait for a scheduled update cycle.
3. Check your patch management process. If you learned about these CVEs from this article rather than from your IT provider, your patch management process has a gap. Document what happened and use it as evidence to improve the process. Ask your MSP or IT support what their monitoring and notification procedure is for critical CVEs.
4. Review your Cyber Essentials scope. If you hold Cyber Essentials certification, confirm that both affected products are either patched, replaced, or removed from scope. Your next renewal assessment will ask about your patch management evidence.
5. Tell someone else. If you are reading this and you know another small business owner using WordPress or WAVLINK hardware, share the specific CVE numbers with them. CVE-2026-120345 and CVE-2026-102435. Two numbers, two patches, one conversation that might prevent a genuinely bad week for a colleague.
Before you go: if you listen to the podcast companion for this piece, follow the show wherever you get your podcasts, leave a rating or review if you found it useful, drop a comment with what you are seeing in your own environment, and share it with someone who runs a small business and would benefit from knowing what is in this week’s threat data. They probably do not have anyone monitoring the NVD for them. Now they can.