Checked as of 31 October 2026.

Six WordPress plugin security notices published on 30 October 2026 cover four products: SimpleForm, NextGEN Gallery (three notices), WP Directory Kit and Acadlix LMS. This is a separate set from our earlier roundup on form plugins. If your site uses none of the four, you can stop here. If it uses one, the sections below give you exactly what to ask your hosting or maintenance provider.

Two framing points first. These are condition-specific risks, not a diagnosis that your site has been affected. The sources we reviewed do not report in-the-wild exploitation for any of the six notices. Fixed versions exist for all of them, so the practical job is confirming what is installed and updating safely.

SimpleForm (slug simple-form), CVE-2026-118235

Affected: 3.10.2 and earlier. Fixed: 3.11.0 or newer.

Wordfence describes an unauthenticated arbitrary file upload reachable through a public form. The access token is printed on the publicly embedded form itself, so it is not a reliable barrier. Whether an uploaded file can execute depends on server configuration, which is why the outcome varies between hosts.

Business effect: any public contact, lead or quiz form built with this plugin could become a drop point for files you never asked for.

Owner action: confirm the slug simple-form and the installed version, list which forms are live on public pages, update to 3.11.0 or newer, then submit one harmless test entry through each public form. Sources: the Wordfence advisory and the plugin page, whose 3.11.0 changelog mentions strict field-key matching and upload directory protection.

CVE-2026-76010 and CVE-2026-76012 affect 4.4.1 and earlier and were first fixed in 4.5.0. Both require an authenticated user who has custom gallery access and already owns a gallery. The first can also reach a subscriber who was ever granted the Manage gallery capability, even if it was later revoked. Under those conditions, either issue can allow code execution on the server, which is the most serious outcome in this roundup. This is not a risk from anonymous visitors or from every subscriber.

CVE-2026-116563 is a stored DOM-based cross-site scripting issue affecting 4.5.4 and earlier, fixed in 4.5.5. It only comes into play when the Shutter or Shutter Reloaded lightbox is active and a malicious comment has been approved. Visitors who then open that gallery could have scripts run in their browser. It does not affect every gallery visitor or every gallery.

Because the fixes span two releases, 4.5.0 is not enough. Ask for 4.5.5 or newer. The vendor changelog for 4.5.5, dated 29 October, names CVE-2026-116563 and permission hardening. The 4.5.0 entry, dated 16 September, covers hardening of older remote code execution surfaces.

Business effect: portfolio, photography and client proofing sites where contributors or clients hold gallery accounts, plus any gallery with comments enabled.

Owner action: review who holds or ever held gallery management rights, check which lightbox is in use and how comments are moderated, update to 4.5.5 or newer, then load a few gallery pages and perform one authorized test upload. Sources: Wordfence on CVE-2026-76010, Wordfence on CVE-2026-76012, Wordfence on CVE-2026-116563 and the plugin changelog.

WP Directory Kit (slug wpdirectorykit), CVE-2026-109197

Affected: 1.6.0 and earlier. Fixed: 1.6.1 or newer.

Wordfence reports an unauthenticated SQL injection that can expose database information. Do not confuse this plugin with Web 2.0 Directory (w2dc), a different product.

Business effect: directory sites usually keep listing details and member records in the database, so this is a confidentiality concern first.

Owner action: confirm the slug wpdirectorykit and the installed version, update to 1.6.1 or newer, then test listing pages and directory search. Sources: the Wordfence advisory and the plugin page, whose 1.6.1 changelog reads Fixed security.

Acadlix LMS (slug acadlix), CVE-2026-103882

Affected: 1.1.9 and earlier. Fixed: 1.2.0 or newer.

The notice describes arbitrary file deletion on the server. According to Wordfence, a generic token emitted on the public front end weakens the access control on the affected route, so a student login should not be treated as a mitigating factor.

Business effect: a learning site that loses files can break course delivery, login or assessments. A preserved backup and a verified restore plan are what make recovery realistic.

Owner action: take a fresh backup of files and database first, update to 1.2.0 or newer, then test course access, login and one assessment with harmless data. Sources: the Wordfence advisory and the plugin changelog, whose 1.2.0 entry dated 23 October says a security issue was fixed with thanks to Wordfence.

The checklist to hand your provider

  • Inventory by exact slug, not display name. Several plugins share similar names.
  • Record the installed version before and after the update.
  • Take a current backup of files and database, and confirm the restore path works. Our backup rules guide explains RPO, RTO and restore testing.
  • Update from the official plugin channel, then verify the installed and active version in the dashboard. A downloaded package is not an applied update.
  • Run harmless functional checks on the features each plugin powers.
  • Preserve logs. If you see unexpected files, users or redirects, investigate that separately. A patch closes a door; it does not prove nobody walked through earlier.

If your site is under a WordPress maintenance arrangement, ask what version tracking and update verification are within its scope.

Facts checked as of 31 October 2026 against the linked sources.