Two WordPress plugin vulnerabilities were reported publicly this week, and both already have fixed versions. Neither touches WordPress core, and they sit in different plugins and different code paths. What you need to do depends on which plugins and which configuration you actually run, so check both sections. Everything below is checked as of November 3, 2026.

1. WP Fastest Cache: a cached activation page may expose new Multisite credentials (CVE-2026-111464)

What was reported. Wordfence published an advisory on 2 November 2026, updated 3 November, credited to researcher R3D: WP Fastest Cache <= 1.5.3 unauthenticated sensitive information exposure. Affected: the plugin with slug wp-fastest-cache, versions up to and including 1.5.3. Fixed in 1.5.4.

What the problem is. On an affected Multisite network, the plugin could cache the account-activation response and serve it to later visitors. That cached page may contain the username and the 12-character plain-text password generated for the most recently activated registrant.

Who is actually affected. All of these must apply at the same time:

  • WordPress Multisite running in subdirectory mode.
  • Public user registration and public site registration both enabled.
  • A genuine registrant has followed the activation link, so an activation response exists to be cached.

A typical single-site install with this plugin does not match that scenario, and the report does not describe every visitor or every account being exposed.

What to do.

  1. Open Plugins > Installed Plugins and note the WP Fastest Cache version. If it is 1.5.3 or earlier, update to 1.5.4 or newer. The vendor changelog for 1.5.4 describes excluding the activation page and activation cookie or install state from caching, and honouring no-cache, private and no-store headers.
  2. If your network matches the prerequisites, clear the plugin cache and any server or CDN cache in front of it, so no older activation response remains.
  3. Review the period during which registration was open while a vulnerable version was installed. If a registrant’s credentials may have been cached, reset that account’s password and sign out its sessions.

Uncertainty. The Wordfence report does not describe observed exploitation, and that is not the same as evidence that none occurred. Updating stops future caching of the activation page. It cannot show whether a cached page was read earlier.

2. Ultra Addons for Contact Form 7: unauthenticated file deletion through the PDF feature (CVE-2026-102435)

What was reported. Wordfence published on 2 November 2026, credited to researcher Sawyer: Ultra Addons for Contact Form 7 <= 3.5.54 unauthenticated PHP object injection to arbitrary file deletion. The plugin, also listed as Ultimate Addons, uses the slug ultimate-addons-for-contact-form-7. Affected: versions up to and including 3.5.54. Fixed in 3.5.55.

What the problem is. Unsafe object handling and path validation in a Contact Form 7 form field let an unauthenticated visitor delete files on the server. Under additional conditions, deleting certain files could open the way to arbitrary code execution. That is a possible outcome, not an automatic one.

Who is actually affected. Contact Form 7 installed, Ultra Addons installed, the PDF Generator addon active, and at least one form configured to generate PDFs. Plain Contact Form 7 without the addon, or with the addon but no PDF configuration, is not automatically affected.

What to do.

  1. Check the Ultra Addons version. If it is 3.5.54 or earlier, update to 3.5.55 or newer. The vendor changelog entry for 3.5.55, dated 11 October 2026, records the Wordfence-reported issues as resolved, and the Wordfence advisory confirms the fix.
  2. If you cannot update immediately, ask your maintainer or hosting provider to assess temporarily disabling the PDF feature. That reduces exposure while you arrange the update. It is not a verified complete fix, and the vendor-patched version remains the recommended remedy.
  3. After updating, submit a test entry with non-private data through a PDF-enabled form and confirm the PDF is still produced.

Uncertainty. The update does not restore any file removed earlier. Your real safety net is a backup you have actually restored from, as covered in our backup strategy guide. A high severity score describes potential impact. It is not evidence of active attacks.

Before and after either update

  • Record the installed version and the relevant settings: registration mode for Multisite, PDF configuration for Contact Form 7.
  • Take a backup before changing anything.
  • Update, then confirm the running version and that registration or your critical forms still work.
  • Keep an eye on error logs for a few days. Monitoring beyond uptime explains what is worth watching.

For the broader routine, see how to secure your WordPress website.