Tip: if WP Libre Form is installed, deactivate/delete it today and deny PHP under upload paths

operational guidance (Patchstack CVE-2026-118423, Nov 6); no official plugin patch2026-11-06

wp-admin → Plugins → Deactivate → Delete WP Libre Form (export form definitions first if you still need them).
Nginx/Apache: location ~* /wp-content/uploads/.*\.php$ { deny all; } (plus any plugin-specific upload path).
Hunt: unexpected .php/.phtml under uploads since at least Nov 3; compare core/plugin checksums; rotate salts and admin credentials if you find webshells.