WordPress Backdoors and SharePoint Exploits: Two Preventable Threats

Two critical vulnerabilities demand immediate attention from UK small businesses. WordPress plugins Fluent Forms Pro and Ninja Tables Pro were distributed with backdoored updates that bypass authentication, establish hidden API endpoints, and persist even after plugin removal (CVE-2026-73532 and CVE-2026-73533, both rated CVSS 9.8). Separately, Microsoft SharePoint faces active exploitation after proof-of-concept code emerged for an authentication bypass vulnerability (CVE-2026-55040), which when combined with CVE-2026-63520 enables unauthenticated remote code execution. Both threats were preventable through basic operational hygiene: verifying plugin sources and applying available patches. UK businesses running WordPress must check for unexpected PHP files in mu-plugins and uploads directories, audit administrator accounts, and verify clean backups. Those with on-premises SharePoint installations must confirm patch status immediately, particularly if working towards Cyber Essentials certification. The episode examines the compressed exploitation timeline, UK GDPR implications, and specific remediation steps for each vulnerability.

Chapters

• Introduction: Preventable Doors Left Open Corrine introduces two critical vulnerabilities affecting UK small businesses, both preventable through basic operational hygiene rather than expensive security technology.
• WordPress Plugin Backdoor via Poisoned Updates Analysis of compromised WordPress plugins Fluent Forms Pro and Ninja Tables Pro (CVE-2026-73532 and CVE-2026-73533), which established hidden REST API backdoors, persistent PHP files, and passwordless administrator accounts through tampered update mechanisms. Covers UK GDPR implications and specific remediation steps beyond simple plugin removal.
• Follow and Share The Daily CVE Update Brief call to action encouraging listeners to follow, review, and share the show with fellow business owners and IT managers.
• SharePoint Authentication Bypass Under Active Exploitation Examination of CVE-2026-55040 and CVE-2026-63520 affecting on-premises SharePoint installations, detailing the compressed timeline from patch availability to active exploitation following proof-of-concept publication. Addresses Cyber Essentials compliance requirements and MSP accountability.
• Practical Summary and Operational Guidance Actionable checklist for both vulnerabilities, emphasising verification steps for WordPress installations and patch confirmation for SharePoint environments, with focus on building consistent security posture over time.

Links

• https://www.rapid7.com/blog/post/2026/08/11/cve-2026-55040-sharepoint-authentication-bypass/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
• https://www.wordfence.com/blog/2026/08/fluent-forms-ninja-tables-compromised/
• https://www.ncsc.gov.uk/cyberessentials/overview