CVSS 10.0 Router Flaw and WordPress File Deletion Exploit
CVSS 10.0 Router Flaw and WordPress File Deletion Exploit
Two maximum-severity vulnerabilities published on 2 November 2026 pose immediate threats to UK small businesses. CVE-2026-120345 is a CVSS 10.0 unauthenticated remote code execution flaw in WAVLINK WN551X3-A routers, allowing attackers to execute arbitrary commands via a DNS handler without any user interaction. CVE-2026-102435 scores 9.8 and affects the Ultra Addons for Contact Form 7 WordPress plugin, permitting unauthenticated file deletion that can lead to complete site takeover. Both vulnerabilities have public exploits already…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.