Weekly Cybersecurity Summary: 27 October to 2 November 2026

The Heart Internet Team is aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This summary covers four issues, all in widely used content management systems: WordPress core, two WordPress components, and Drupal Commerce.

WordPress 7.1.4, released on 28 October, fixed an unauthenticated remote code execution flaw in the way full-package core upgrades stage files. The staging paths used during an upgrade were predictable and reachable from the web, which creates a race condition: an attacker who times a request during an upgrade window may be able to get their own code executed. Patchstack described exploitation as difficult. A CVE identifier, CVE-2026-119977 (CVSS 8.1), was published on 1 November for the issue.

Shared hosting: sites with automatic core updates enabled should already be on 7.1.4, but sites that have updates disabled or that were blocked by file permissions need checking.

VPS and dedicated servers: confirm that every WordPress install you manage is on 7.1.4 or later, including staging and rarely visited sites.

Update WordPress to 7.1.4 or later and confirm the version from the dashboard or with wp core version.

Drupal published security advisory SA-CONTRIB-2026-254 on 28 October for the Commerce Core module. Insufficient protection around certain routes and entity fields lets a request reach functions or data it should not control, and Drupal has warned that the flaw is being exploited against online stores. Drupal rates it 21 out of 25 (highly critical). The advisory does not describe the attack method in detail, and reports do not confirm remote code execution or full site takeover, but order and data tampering is possible. The date exploitation began has not been confirmed by a second source.

Shared hosting: any Drupal shop using Commerce is exposed until it is updated, and no login is needed to attempt the attack.

VPS and dedicated servers: update the module, then review recent orders for unusual prices or changed fields.

Update Commerce Core to 8.x-2.41 or 3.3.13 and audit recent orders and payment records.

A vulnerability published on 30 October affects the FunnelKit Automations WordPress plugin. Untrusted data is deserialised without sufficient checks, which allows an unauthenticated visitor to inject PHP objects and, where a suitable gadget chain exists, execute code on the server. The CVSS score is 9.8. The details come from a single aggregator source and should be checked against the vendor and Patchstack advisories.

Shared hosting: WooCommerce shops using FunnelKit are the likely audience, and the flaw needs no account.

VPS and dedicated servers: use your plugin inventory to find installs and update them.

Update FunnelKit Automations to the latest release, or deactivate it until a fix is installed.

The Avada theme from ThemeFusion has an unauthenticated arbitrary file upload in its convert_palette_images_to_truecolor function, which can lead to remote code execution. It was published on 1 November with a CVSS score of 8.1. Avada is one of the most widely installed premium themes, so the potential number of affected sites is large. This is also a single-source report.

Shared hosting: Avada is bundled with many agency-built sites, which may not receive updates promptly.

VPS and dedicated servers: Check theme versions across all sites and update through the usual theme update channel.

Update Avada to the latest release and look for unexpected files in wp-content/uploads and the theme directory.

If you need help, open a support ticket from the Customer Area at heartinternet.uk, use live chat Monday to Friday 09:30 to 16:00, or browse the knowledge base at heartinternet.uk/support.

We will keep customers informed as further information becomes available.