WordPress Plugin and Router Botnet Threats Demand Immediate Patching

This episode examines two active cybersecurity threats affecting UK small businesses: CVE-2026-15748, a critical unauthenticated remote code execution vulnerability in the Forminator Forms WordPress plugin with over 600,000 installations, and Evooo1Bot, a Linux botnet targeting unpatched routers and edge devices using decade-old vulnerabilities. Corrine explains how both threats exploit the absence of basic patching practices, why automated scanning makes business size irrelevant as a defence, and provides practical steps for checking WordPress plugin versions and router firmware. The episode connects these immediate threats to broader patterns covered throughout the series, including Cyber Essentials requirements, UK GDPR obligations when breached through known vulnerabilities, and the commercial value of demonstrable security hygiene. With clear instructions for non-technical business owners and guidance on engaging IT providers, the briefing translates intelligence feed data into actionable tasks that cost nothing but demand attention today.

Chapters

• Introduction Corrine introduces two active threats targeting infrastructure commonly used by UK small businesses: WordPress websites and office routers, both requiring immediate attention.
• 600,000 WordPress Sites, One Plugin, No Login Required Analysis of CVE-2026-15748, a critical unauthenticated remote code execution vulnerability in Forminator Forms WordPress plugin, with practical steps for checking and updating plugin versions.
• Community Support Request Brief call to action encouraging listeners to follow, review, and share the podcast with other small business owners.
• Your Router May Already Be Someone Else’s Infrastructure Examination of Evooo1Bot, a Linux botnet exploiting vulnerabilities dating back to 2016 to turn routers into SOCKS5 proxies, with guidance on checking and updating router firmware.
• What These Two Stories Have in Common Discussion of the shared logic behind both threats: automated, opportunistic scanning that treats all internet-connected systems equally regardless of business size or sector.
• Making the Business Case Three practical arguments for prioritising patching: zero remediation cost, documented active exploitation, and commercial value of demonstrable security hygiene including Cyber Essentials alignment.
• Conclusion and Action Items Summary of two immediate tasks: checking WordPress plugins and router firmware, with guidance for businesses that outsource technical management.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog