Five New BitNinja WAF Rules Defend WordPress Sites Against UpdraftCentral, Bricksforge, and OttoKit Attacks

Another week, another few critical vulnerabilities, plus a key leak. I guess we better get used to this.

Our new BitNinja WAF rules target three serious WordPress plugin threats involving UpdraftCentral, Bricksforge, and OttoKit. Each vulnerability can give attackers a path toward compromising a site (or a whole server).

BitNinja's WAF2 and WAFPro rules help stop these attacks before site owners have updated the affected plugins.

UpdraftCentral: rules 406056 and 406057

Rules 406056 and 406057 defend against attacks abusing compromised UpdraftCentral keys:

• 406056 blocks UpdraftCentral commands sent with a non-dashboard User-Agent.
• 406057 blocks the UpdraftCentral backdoor login token.

Please note, that rule 406056 may also block legitimate UpdraftCentral use, users who rely on UpdraftCentral can disable this rule if necessary, although advised against

Bricksforge: CVE-2026-85097

Rules 406058 and 406059 address CVE-2026-85097, an unauthenticated PHP file upload vulnerability in the Bricksforge plugin. The attack uses the temporaryFileUploads functionality through admin-ajax.

An unauthenticated file upload can provide attackers with a route to place malicious PHP files on a site, potentially leading to full site takeover. The risk is especially significant on shared hosting, where a compromised WordPress installation can endanger the server environment.

OttoKit: CVE-2026-110372

Rule 406060 blocks CVE-2026-110372, an authentication bypass in the OttoKit plugin. The vulnerability involves the plugin's connection-denied secret and can allow attackers to bypass normal authentication protections.

As with the other threats covered here, successful exploitation can put the affected WordPress site under an attacker's control.

Update affected plugins promptly

WAF protection provides an important defensive layer while site owners update their software. However, administrators should still update the affected plugins promptly and review their WordPress installations for signs of compromise.

BitNinja customers using WAF2 or WAFPro can use rules 406056–406060 to help block these attack paths. If legitimate UpdraftCentral functionality is required, rule 406056 can be disabled; otherwise, keeping the rule enabled adds protection against the targeted UpdraftCentral command abuse.