CMS Vulnerabilities in 2026: What This Year's Attacks Share
WordPress plugins, a Ghost SQL injection, Drupal and PHP itself: 2026's worst CMS flaws follow the same few patterns. Here is what they share and how to protect a self-hosted blog.
The worst CMS vulnerabilities of 2026 share three patterns: most sat in plugins or extensions rather than the core, several were in the runtime underneath every site, and attackers exploited them within hours or days of disclosure. The defence is the same for any platform: fewer add-ons, a patched runtime, and updates applied quickly.
2026 has been a busy year for anyone who runs a content management system. WordPress plugins were exploited within days of disclosure, a Ghost flaw was used to plant malware on hundreds of well-known sites, Drupal shipped emergency fixes, and PHP itself needed an urgent patch. Read one by one, they look like bad luck. Read together, they follow a few clear patterns, and those patterns tell you how to protect any self-hosted blog, whatever it runs on.
The incidents, briefly
- WordPress: Bricksforge plugin (CVE-2026-85097). An unauthenticated file upload that runs attacker code, rated critical (9.8 to 10.0). Fixed in 3.1.8.10; exploitation attempts were seen from 7 October. Elementor Pro had a similar critical upload flaw exploited in September.
- Ghost: Content API SQL injection (CVE-2026-26980). Fixed in February. Attackers used it on more than 700 sites, including ones run by Harvard, Oxford and DuckDuckGo, to steal the Admin API key and inject malicious JavaScript into published articles.
- Drupal: core and contributed modules (CVE-2026-108097, CVE-2026-108099). Remote code execution through the core Field UI module, reachable via contributed modules, one path without logging in. Fixed in core 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10.
- Joomla: page-builder and editor extensions. Critical flaws in popular third-party extensions were exploited over the summer, and one was added to CISA's Known Exploited Vulnerabilities list.
- PHP itself: PHP2Shell (CVE-2026-109618, CVE-2026-109619). Flaws in the interpreter that reach every PHP site at once, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We covered what it means for WordPress in our WordPress migration guide.
- .NET: the October security update. ASP.NET Core 10.0.13 fixed dozens of CVEs, none exploited at release. Every .NET web application needs it, Inkwell included.
Pattern 1: the extensions are the soft spot
Bricksforge, Elementor Pro, Drupal's Entity List and the Joomla extensions were all add-ons, not the core product. Each add-on brings its own code, its own maintainers and its own release schedule, and attackers know that many sites install a plugin once and never update it. The more extensions a site runs, the more of them it has to watch.
Pattern 2: the runtime underneath counts too
PHP2Shell needed no plugin at all: it sat in the language every PHP site runs on. The same is true of any stack. A .NET application depends on the ASP.NET Core runtime, a Ghost site on Node.js, and a patched application on an unpatched runtime is still exposed.
Pattern 3: the window is hours, not weeks
Drupal's security team told site owners to set time aside for the update because exploits might appear within hours or days. Bricksforge attempts began soon after disclosure. And the Ghost campaign shows the other side: a fix released in February did not protect sites that had not applied it months later.
A patch only protects the sites that install it. The gap between release and update is where most of 2026's damage happened.
Pattern 4: attackers want your readers
The Ghost attackers did not just deface pages. They used stolen API keys to edit real articles and add scripts aimed at readers. A compromised blog becomes a way to reach its audience, and it can take a domain's search reputation down with it.
A checklist for any self-hosted blog
- Know every component you run: the application, each plugin or extension, and the runtime underneath.
- Subscribe to security announcements for each one, and plan time for updates the day they ship.
- Remove plugins and themes you no longer use.
- Turn on two-factor authentication for every account that can publish.
- Treat API keys like passwords: rotate them after any incident.
- Keep tested backups, so a compromise means a restore, not a rebuild.
Where Inkwell stands
None of the WordPress, Ghost, Drupal, Joomla or PHP flaws above apply to Inkwell, which is a .NET 10 application with its features in its own repository. That does not make it immune. It relies on the ASP.NET Core 10 runtime, so the October .NET update applies to every Inkwell server, and Docker users should rebuild on the current runtime image.
Inkwell has had its own security fixes too. Version 1.0.9 closed sign-up once a site has its first account, made API tokens follow Desk permissions and re-check the account on every request, ended the session of a disabled user, and stopped the example API key from working. Each is listed in a dated Security section of the changelog, and the security notes in the documentation describe how the platform handles sign-in, analytics and uploads. Being open about fixes is part of the job: you cannot patch what you are not told about.
Frequently asked questions
What were the biggest CMS vulnerabilities of 2026?
Among the most serious were an unauthenticated code-execution flaw in the Bricksforge WordPress plugin, a Ghost Content API SQL injection used against more than 700 sites, remote code execution in Drupal core and contributed modules, exploited Joomla extensions, and PHP2Shell in PHP itself.
Are plugins the main security risk for a CMS?
For most of 2026's serious incidents, yes. The exploited WordPress, Drupal and Joomla flaws were in add-ons rather than the core product. Fewer plugins, all kept updated, means less code to watch.
How quickly should I apply a CMS security update?
As soon as it ships, ideally the same day. Drupal's security team warned that exploits could appear within hours or days, and the Ghost campaign hit sites that had not applied a fix released months earlier.
Is Inkwell affected by the WordPress, Ghost and Drupal vulnerabilities?
No. Those flaws are in other platforms' code. Inkwell runs on .NET 10, so it does need the ASP.NET Core security updates, and it publishes its own security fixes in a dated changelog section, most recently in version 1.0.9.
Ready to host your own blog?
Inkwell is free, open-source, and self-hosted — your content, your server, your rules. Deploy in minutes on .NET 10.