Three WordPress plugin advisories were published or updated on 3 November 2026. We checked them as of 4 November 2026. They are separate issues in three unrelated plugins. None of them is a flaw in WordPress core, and the third is not a weakness in Cloudflare’s Turnstile service. The sources we used do not establish whether any of them has been used against real sites, so we make no claim either way.

Each item below covers who is affected, what it could mean for your business, what to do, and where the details come from.

1. Remove Google Fonts (use-bunnyfont-host-google-fonts), CVE-2026-97397

Who is affected. Sites running version 1.7 or earlier of the plugin Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance. As of 4 November 2026, 1.7 is still the vendor’s current release and the Wordfence notice lists no patched version, so no known patch is available as of that date. A later release may change this, so check the vendor readme before acting.

What could happen. The plugin rewrites page output to strip Google Fonts. In Remove mode, that rewriting can mangle text from a published comment so that script submitted by an unauthenticated visitor runs in the browser of anyone who views the page. Two conditions must both hold: Remove mode is active, and the malicious comment has been published, either through manual moderator approval or through auto-approval for commenters who were approved before.

What to do. Ask your website provider to check whether this plugin is installed and which mode it uses. Because no known patch is available as of 4 November 2026, the bounded request is to deactivate or remove the plugin and assess a trusted alternative, then test that your fonts still load correctly. Holding new comments unpublished for now reduces exposure but is not a verified fix. Do not assume that switching to a different mode resolves the issue; the advisory does not say that.

Source. Wordfence advisory and vendor readme.

2. Import and export users and customers (import-users-from-csv-with-meta), CVE-2026-120554

Who is affected. Versions up to and including 2.5.11. The vendor fixed it in 2.5.12, and the current release is 2.5.13.

What could happen. This is a narrow privilege escalation. It does not come from an ordinary CSV upload, and an ordinary Subscriber without the required capabilities is not the role the notice specifies. What decides exposure is the actual capabilities a role holds and whether the scheduled-import prerequisites are met. The notice describes a logged-in user holding a custom delegated role that has the create_users capability but lacks both promote_users and edit_users. The plugin saved its scheduled-import settings in several steps, and some values were stored before the permission check rejected the request. If an administrator had previously saved the scheduled import settings, and no successful save happened before the next unattended run, the attacker could point the import at their own CSV file and gain Administrator access. The fix in 2.5.12 checks all permissions before storing anything and stops reusing stale administrator permissions.

What to do. Update to 2.5.12 or newer, after a backup and a check that the version is compatible with your site. Then review the unattended import configuration, confirm the CSV source is one you trust, and review which delegated roles exist and which accounts hold Administrator.

Source. Wordfence advisory and vendor readme.

3. Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile), CVE-2026-93900

Who is affected. Versions up to and including 1.44.3 on sites that use the Gravity Forms integration shortcode. Fixed in 1.44.4, released 30 October 2026. The current release 1.44.5 contains separate fixes that are not part of this CVE.

What could happen. A user with Contributor access or higher can place a crafted value in the id attribute of the [gravity-simple-turnstile] shortcode. The plugin’s output handling lets that value run as script for anyone viewing the page. This is a plugin output-handling bug, not a breach of Cloudflare’s Turnstile platform and not a CAPTCHA bypass.

What to do. Update to 1.44.4 or newer, after a backup and a compatibility check. Then validate that your forms still render and submit, and review which accounts hold Contributor or Author roles.

Source. Wordfence advisory and vendor readme.

Shared steps for all three

  • Back up before any change, following the practices in our backup strategy guide.
  • Update or remove, then verify the site still works as expected.
  • Watch for unexpected changes afterwards. Our article on monitoring beyond uptime explains what to watch.
  • If you find unexpected content, admin accounts, or scheduled tasks, preserve evidence before cleaning. Our guide on what to do when a website is hacked covers that.

Installing the verified fix, or removing the plugin that has no known patch, addresses the specific issue described for that plugin. This roundup does not establish that any site is free of current compromise, and it does not clear other plugins on the same site. Those need their own checks.