A customer website, a staff login service and a backup platform serve different purposes, but a weakness in any one can interrupt a small business. Fresh advisories from Qatar and Saudi Arabia bring all three into focus. For founders, CTOs and software houses serving customers in the UAE, Saudi Arabia and Oman, the useful question is which of these technologies sits behind a revenue-generating service—and who can prove it has been checked.
WordPress: a new campaign changes the patching conversation
Qatar’s National Cyber Security Agency issued an advisory on 7 October about active exploitation of Ninja Forms and WPC Product Bundles for WooCommerce. The vulnerabilities were publicly disclosed in September; the new development is exploitation evidence. Patchstack’s 6 October investigation reports first observing the campaign against WPC Product Bundles on 4 October and Ninja Forms on 5 October. [1][2]
The affected versions are Ninja Forms through 3.15.3 (CVE-2026-94504) and WPC Product Bundles through 8.6.6 (CVE-2026-93836). Malicious stored content can run when an administrator views a submission or order. Patchstack found a payload designed to establish persistent access, including an administrator account hidden from the dashboard. Its report does not identify a GCC victim. [2]
For a software house maintaining customer websites, this makes “the plugin is updated” an incomplete answer if exploitation may already have occurred. Potential business effects include loss of control over the website and disruption of customer enquiries or orders; these are risk scenarios, not reported regional losses.
Check each maintained site. The original fixes are Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7; use a current supported release, checking subsequent security changes and compatibility. The upstream changelogs corroborate those fixes. Where suspicious activity appears, preserve logs and arrange an investigation for persistence rather than relying on the visible Users screen alone. [2][3][4]
NetScaler: an earlier upgrade may leave a new gap
Citrix published a new bulletin on 8 October for CVE-2026-107406, followed by Saudi NCA’s critical alert on 9 October. The issue can cause remote code execution or denial of service in affected NetScaler ADC and Gateway deployments using SAML authentication. Applicability depends on both configuration and build: some recent builds are affected only in identity-provider mode, while earlier builds can be affected in either service-provider or identity-provider mode. [5][6]
The updated standard builds are 14.1-73.46 and 13.1-64.29 or later in their respective branches; FIPS and NDcPP deployments have separate build requirements. A previous upgrade is not evidence that this newer issue is resolved. Citrix’s accompanying guidance states that, at bulletin publication, it was not aware of “any unmitigated exploits” of this vulnerability. That statement does not establish a GCC incident or guarantee absence of compromise. [6][7]
If a gateway supports staff access or customer applications, possible consequences include interrupted authentication or access to sensitive systems. Ask the infrastructure owner or provider to compare the actual SAML role and installed build with the bulletin, apply the relevant update, and verify that critical login journeys still work. [6]
Veeam: include the recovery platform in the security review
On 6 October, Veeam disclosed vulnerabilities fixed in Backup & Replication 12.3.2 P4, and Saudi NCA issued a critical alert. One, CVE-2025-64393, allows a user with the Backup Viewer role to execute code on the backup server. The listed issues affect version 12 builds through 12.3.2.4854 and are resolved in build 12.3.2.4934. Version 13 is outside this bulletin’s affected scope; that does not mean every version 13 build is free of other vulnerabilities. [8][9]
The business concern is whether the system relied on for recovery could itself become an attacker’s route in. Confirm the installed branch and applicable update, and review who holds backup roles. Separately, test restoration of a critical workload. CISA’s standing ransomware guidance recommends offline, encrypted backups and regular tests of their availability and integrity. A successful backup job alone does not demonstrate that operations can be restored. [9][10]
Three actions for this week
- Confirm scope: list affected websites, gateways and backup servers, with their owners, installed versions and relevant configurations.
- Separate remediation from investigation: record update completion, but investigate suspicious activity on exposed WordPress sites where persistence is possible. [2]
- Verify business function: test enquiries or checkout, staff authentication and recovery of a critical workload, then record unresolved gaps. [10]
A useful question for an MSP or software partner to ask a customer is: “Which of these systems could stop your business tomorrow, and what evidence do we have that it is secure and recoverable?”
If those answers remain unclear, contact Nordic Defender to discuss a security assessment scoped to the systems your business depends on. Bring the asset list, known exposure and outstanding questions so the conversation starts with a concrete need. [11]
Sources
- Qatar National Cyber Security Agency — Actively Exploited WordPress Plugin Vulnerabilities — Published 7 October 2026.
- Patchstack — Four ways back in: the WordPress XSS campaign that hides its own admin account — Published 6 October 2026.
- Ninja Forms — Upstream changelog on WordPress.org — Version 3.15.4 entry dated 21 September 2026; version 3.15.5 dated 28 September 2026.
- WPClever — WPC Product Bundles for WooCommerce changelog on WordPress.org — Individual release dates not stated in the changelog.
- Saudi National Cybersecurity Authority — Citrix Alert 2026-7908 — Published / updated 9 October 2026.
- Citrix / Cloud Software Group — NetScaler security bulletin CTX697191, CVE-2026-107406 — Published / updated 8 October 2026.
- Citrix — Protecting Customers: Immediate Guidance for CVE-2026-107406 — Updated 8 October 2026, 5 PM Pacific Daylight Time.
- Saudi National Cybersecurity Authority — Veeam Alert 2026-7900 — Published / updated 6 October 2026.
- Veeam — KB4934: Vulnerabilities Resolved in Backup & Replication 12.3.2 P4 — Published / updated 6 October 2026.
- CISA and partners — #StopRansomware Guide — Revised 19 October 2023; standing prevention and recovery guidance.