Critical Router and WordPress Vulnerabilities Demand Immediate Action

This episode examines two urgent threat areas affecting UK small businesses: three critical router vulnerabilities with maximum severity scores and publicly available exploit code, and a cluster of WordPress plugin and theme flaws including an authentication bypass that grants administrator access without credentials. Corrine analyses CVE-2026-82542 affecting the Tenda HG10 router with a CVSS score of 10.0, two critical D-Link DIR-825M vulnerabilities scoring 9.9, and CVE-2026-15980 affecting the MyHome Core WordPress plugin with a score of 9.8. The episode highlights how widely deployed commodity hardware and popular WordPress plugins create exploitable attack surfaces in small office environments. Practical guidance covers identifying affected devices, applying firmware updates, auditing WordPress installations, and establishing basic monthly review processes. The common thread across both threat areas is unmanaged infrastructure: routers and websites that accumulate over time without systematic patching processes. Corrine emphasises that these are not sophisticated attack chains but documented, publicly exploitable flaws in equipment and software currently running in small businesses across the UK.

Chapters

• Introduction Corrine introduces two critical threat areas: router vulnerabilities with maximum severity scores and public exploits, and WordPress flaws including authentication bypass vulnerabilities affecting commodity hardware and websites in UK small businesses.
• The Router Problem Nobody Is Talking About Analysis of three critical router CVEs: CVE-2026-82542 affecting Tenda HG10 with CVSS 10.0, and CVE-2026-82592 and CVE-2026-82593 affecting D-Link DIR-825M both scoring 9.9. Examination of why these widely deployed devices represent a persistent structural problem in small business network security, with practical steps for checking models and applying firmware updates.
• Call to Action Brief request for listeners to follow the show, leave ratings and reviews, and share the episode with small business owners managing office networks.
• WordPress: When Your Website Becomes the Attack Vector Detailed coverage of CVE-2026-15980 in MyHome Core plugin scoring 9.8, which allows unauthenticated attackers to obtain administrator cookies. Discussion of critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, with guidance on auditing WordPress installations and removing unused plugins.
• The Common Thread: Unmanaged Infrastructure Examination of how both router and WordPress vulnerabilities stem from the same underlying issue: absence of systematic patch management processes in small businesses. Discussion of how basic monthly review processes can provide competitive advantage and support Cyber Essentials compliance.
• Conclusion Summary of critical actions required this week: checking router models, applying WordPress updates, auditing installed plugins, and establishing consistent monthly patch management processes.