Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,161 results · page 13 of 24
Jul 17, 2026AI Copilot: Does not bind OAuth access tokens to a WordPress userCVE-2026-9810 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
- Product
- AI Copilot
- Fixed in
- 1.5.4
- What to do
- Update AI Copilot to 1.5.4 or newer.
Jul 17, 2026Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit: Privilege EscalationCVE-2026-15982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.
- Product
- Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2026Bricksforge: Privilege EscalationCVE-2026-14956 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form. Successful exploitation requires that the site has a public Bricksforge Pro Forms element configured with the User Registration action.
- Product
- Bricksforge
- Affected
- up to 3.1.8.6
- What to do
- Affects up to 3.1.8.6. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2026Happy Coders OTP Login for WooCommerce: Does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifierCVE-2026-12492 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
- Product
- Happy Coders OTP Login for WooCommerce
- Fixed in
- 2.8
- What to do
- Update Happy Coders OTP Login for WooCommerce to 2.8 or newer.
Jul 16, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-15013 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.
- Product
- SAML Single Sign On – SSO Login
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update SAML Single Sign On – SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 14, 2026Podlove Podcast Publisher: Arbitrary file uploadsCVE-2026-13001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 14, 2026Word Count and Social Shares: Does not validate a user-supplied file path before deletionCVE-2026-11563 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).
- Product
- Word Count and Social Shares
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Word Count and Social Shares to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026wpWax Directorist directorist: Deserialization of Untrusted DataCVE-2026-59518 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.
- Product
- wpWax Directorist directorist
- What to do
- Update wpWax Directorist directorist to the newest version.
Jul 13, 2026Sergey AIWU ai-copilot-content-generator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-59515 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
- Product
- Sergey AIWU ai-copilot-content-generator
- What to do
- Update Sergey AIWU ai-copilot-content-generator to the newest version.
Jul 13, 2026properfraction MailOptin mailoptin: Incorrect Privilege AssignmentCVE-2026-57813 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <= 1.2.77.3.
- Product
- properfraction MailOptin mailoptin
- What to do
- Update properfraction MailOptin mailoptin to the newest version.
Jul 13, 2026Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl: Improper Control of Generation of Code ('Code Injection')CVE-2026-57811 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.
- Product
- Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl
- What to do
- Update Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl to the newest version.
Jul 13, 2026ThemeGoods Grand Photography grandphotography: Deserialization of Untrusted DataCVE-2026-57770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.
- Product
- ThemeGoods Grand Photography grandphotography
- What to do
- Update ThemeGoods Grand Photography grandphotography to the newest version.
Jul 13, 2026stmcan RT-Theme 18 | Extensions rt18-extensions: Deserialization of Untrusted DataCVE-2026-57744 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
- Product
- stmcan RT-Theme 18 | Extensions rt18-extensions
- What to do
- Update stmcan RT-Theme 18 | Extensions rt18-extensions to the newest version.
Jul 13, 2026AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57739 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.
- Product
- AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing
- What to do
- Update AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing to the newest version.
Jul 13, 2026axiomthemes 777 triple-seven: Deserialization of Untrusted DataCVE-2026-57738 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.
- Product
- axiomthemes 777 triple-seven
- What to do
- Update axiomthemes 777 triple-seven to the newest version.
Jul 13, 2026Themeum Kirki kirki: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57726 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.
- Product
- Themeum Kirki kirki
- What to do
- Update Themeum Kirki kirki to the newest version.
Jul 13, 2026Themeum Kirki kirki: Deserialization of Untrusted DataCVE-2026-57724 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
- Product
- Themeum Kirki kirki
- What to do
- Update Themeum Kirki kirki to the newest version.
Jul 13, 2026CodeRevolution Aimogen Pro aimogen-pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-57719 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.
- Product
- CodeRevolution Aimogen Pro aimogen-pro
- What to do
- Update CodeRevolution Aimogen Pro aimogen-pro to the newest version.
Jul 13, 2026LatePoint LatePoint latepoint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57714 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.
- Product
- LatePoint LatePoint latepoint
- What to do
- Update LatePoint LatePoint latepoint to the newest version.
Jul 13, 2026quantumcloud WoowBot Pro Max woowbot-pro-max: Unrestricted Upload of File with Dangerous TypeCVE-2026-57710 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.
- Product
- quantumcloud WoowBot Pro Max woowbot-pro-max
- What to do
- Update quantumcloud WoowBot Pro Max woowbot-pro-max to the newest version.
Jul 13, 2026quantumcloud Simple Business Directory Pro simple-business-directory-pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57707 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.
- Product
- quantumcloud Simple Business Directory Pro simple-business-directory-pro
- What to do
- Update quantumcloud Simple Business Directory Pro simple-business-directory-pro to the newest version.
Jul 13, 2026Melograno Venture Studio Amelia ameliabooking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57702 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.4.2.
- Product
- Melograno Venture Studio Amelia ameliabooking
- What to do
- Update Melograno Venture Studio Amelia ameliabooking to the newest version.
Jul 13, 2026Brainstorm Force SureDash suredash: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57401 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.
- Product
- Brainstorm Force SureDash suredash
- What to do
- Update Brainstorm Force SureDash suredash to the newest version.
Jul 13, 2026User Registration & Membership: Does not verify the authenticity of incoming payment-provider webhook notifications before acting on themCVE-2026-11964 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
- Product
- User Registration & Membership
- Fixed in
- 5.2.2
- What to do
- Update User Registration & Membership to 5.2.2 or newer.
Jul 11, 2026Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authentiCVE-2026-57828 · Websites & servers · reported by security@joomla.orgCritical 9
Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2026Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated CVE-2026-57827 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Vulnerability in Drupal Commerce guest registration.CVE-2026-15089 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026vulnerability in Drupal Mother May I allows .CVE-2026-11913 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection.CVE-2026-12535 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing.CVE-2026-10768 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object InjectiCVE-2026-9726 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026OAuth Single Sign On - SSO (OAuth Client): Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57807 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
- Product
- OAuth Single Sign On - SSO (OAuth Client)
- Affected
- up to 38.5.8
- What to do
- Affects up to 38.5.8. Update OAuth Single Sign On - SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2026miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Authentication bypass leading to account takeoverCVE-2026-12761 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.
- Product
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.7.0
- What to do
- Affects up to 7.7.0. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4.CVE-2026-15300 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.
- Affected
- up to 4.5.4
- Fixed in
- 4.5.5
- What to do
- Update the plugin to 4.5.5 or newer.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026Instant Appointment: Arbitrary file uploadsCVE-2026-15282 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Instant Appointment
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026Super Forms – Drag & Drop Form Builder: Arbitrary File UploadCVE-2026-14894 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed because the super_create_nonce nopriv AJAX action allows any unauthenticated visitor to mint a valid sf_nonce and session cookie in a single prior request, reducing exploitation to two unauthenticated HTTP requests.
- Product
- Super Forms – Drag & Drop Form Builder
- Affected
- up to 6.3.313
- What to do
- Affects up to 6.3.313. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discCVE-2026-56292 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-56291 · Other software · Balbooa · reported by security@joomla.orgExploitedCritical 10
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
- Product
- Forms
- On CISA’s list since
- Jul 10, 2026 (federal fix deadline Jul 13, 2026)
- What to do
- Attackers are using this now. Install Balbooa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jul 9, 2026Blocksy Companion: Arbitrary File UploadCVE-2026-15158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extension via PATHINFO_EXTENSION — allowing double-extension filenames such as shell.woff2.php to pass MIME validation and be handled as permitted font files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable when the premium version of the plugin (blocksy-companion-pro) is installed with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active; the free blocksy-companion plugin does not contain the vulnerable code paths.
- Product
- Blocksy Companion
- Affected
- up to 2.1.46
- What to do
- Affects up to 2.1.46. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-14245 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account — returned in a 302 `Location` header — and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.
- Product
- miniOrange OTP Login, Verification and SMS Notifications
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026Blocksy Companion Pro: Unauthenticated arbitrary file uploadCVE-2026-58480 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.
- Product
- Blocksy Companion Pro
- Fixed in
- 2.1.47
- What to do
- Update Blocksy Companion Pro to 2.1.47 or newer.
Jul 8, 2026WP Learn Manager: Authorization bypassCVE-2026-12153 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.
- Product
- WP Learn Manager
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update WP Learn Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026Eventer: An insecure password reset mechanismCVE-2026-9701 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
- Product
- Eventer
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 8, 2026Simple Coherent Form: Arbitrary file deletionCVE-2026-14487 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
- Product
- Simple Coherent Form
- Affected
- up to 2.4.13
- What to do
- Affects up to 2.4.13. Update Simple Coherent Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 7, 2026DoLeads Integrator WordPress plugin through 0.65, wp2epub: Have been seen to be used to achieve RCECVE-2026-4375 · WordPress plugins & themes · reported by WPScanCritical 9
The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.
- Product
- DoLeads Integrator WordPress plugin through 0.65, wp2epub
- Affected
- up to 0.65
- What to do
- Affects up to 0.65. Update DoLeads Integrator WordPress plugin through 0.65, wp2epub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2026WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell: Remote Code ExecutionCVE-2026-14345 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.
- Product
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
- Affected
- up to 3.12.7
- What to do
- Affects up to 3.12.7. Update WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 7, 2026uncanny-automator-pro: Was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7CVE-2026-12375 · WordPress plugins & themes · reported by WPScanCritical 9.8
The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.
- Product
- uncanny-automator-pro
- Fixed in
- 7.3.0.6
- What to do
- Update uncanny-automator-pro to 7.3.0.6 or newer.
Jul 6, 2026FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager: Do not properly escape a parameter before passing it to a sCVE-2026-6382 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
- Product
- FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager
- Fixed in
- 1.1.9
- What to do
- Update FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager to 1.1.9 or newer.
Jul 3, 2026Printcart Web to Print Product Designer for WooCommerce: Arbitrary File DeletionCVE-2026-9725 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Printcart Web to Print Product Designer for WooCommerce
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026Divi Form Builder: Arbitrary File Upload leading to Remote Code ExecutionCVE-2026-5524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
- Product
- Divi Form Builder
- Affected
- up to 5.1.8
- What to do
- Affects up to 5.1.8. Update Divi Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.