Two critical vulnerabilities demand immediate attention from UK small businesses. WordPress plugins Fluent Forms Pro and Ninja Tables Pro were distributed with backdoored updates that bypass authentication, establish hidden API endpoints, and persist even after plugin removal (CVE-2026-73532 and CVE-2026-73533, both rated CVSS 9.8). Separately, Microsoft SharePoint faces active exploitation after proof-of-concept code emerged for an authentication bypass vulnerability (CVE-2026-55040), which when combined with CVE-2026-63520 enables unauthenticated remote code execution. Both threats were preventable through basic operational hygiene: verifying plugin sources and applying available patches. UK businesses running WordPress must check for unexpected PHP files in mu-plugins and uploads directories, audit administrator accounts, and verify clean backups. Those with on-premises SharePoint installations must confirm patch status immediately, particularly if working towards Cyber Essentials certification. The episode examines the compressed exploitation timeline, UK GDPR implications, and specific remediation steps for each vulnerability.
