Vulnerabilities

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to a critical unauthenticated privilege escalation flaw (CVSS 3.1: 9.8) in all versions up to and including 3.6.2. The plugin fails to verify that a submitted form ID actually corresponds to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. By submitting crafted form data that references an arbitrary post, an unauthenticated attacker can cause the callback to run and create a new administrator-level user account, effectively taking full control of the site. Any WordPress site running the plugin at version 3.6.2 or earlier is affected. No public PoC or known in-the-wild exploitation exists, and the issue is not in CISA's KEV catalog, but the unauthenticated, high-impact nature means defenders should treat it as urgently patchable.

Do: Upgrade JetFormBuilder to a version newer than 3.6.2 (the latest available release) immediately; if no update is available yet, deactivate the plugin or use a firewall/WAF rule to restrict its form-submission endpoint. After patching, review the WordPress user list for any unexpected administrator accounts created recently and check access logs for anomalous form submissions from unauthenticated sources. If a rogue admin is found, remove the account, rotate all credentials and salts, and audit for malicious plugins, uploads, or modified theme files.

The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise.

Do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow a low-privileged attacker to submit workflow components containing socket or urllib imports, which the server executes as arbitrary Python code with root privileges (UID=0) inside the Langflow container. The built-in validation scanner incorrectly returns 'validated': true for these malicious components, giving operators a false sense that submitted flows are safe. Successful exploitation enables AWS credential theft via IMDSv1 SSRF using the instance's full IAM role permissions, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services such as PostgreSQL and Redis on the Docker network. Anyone running a self-hosted Langflow server in the affected range that permits untrusted or semi-trusted users to build and submit flows is affected. The flaw is rated critical (CVSS 9.6), but no public proof-of-concept, known in-the-wild exploitation, or CISA KEV listing exists at this time.

Do: Upgrade IBM Langflow OSS to a version newer than 1.10.0 as soon as IBM releases a fix, and check the IBM PSIRT advisory for the patched build. Do not rely on the component validator's 'validated': true signal — treat all user-submitted components as untrusted and restrict who can create or import flows. Harden the environment by running the container as a non-root user, enforcing IMDSv2 (disable IMDSv1) on cloud hosts, segmenting the Docker network from databases like PostgreSQL/Redis, and rotating AWS credentials and other secrets if untrusted flows were ever executed.

CVE-2026-65374 is an out-of-bounds write (memory corruption) flaw in Apple macOS's handling of WebDAV connections, rated 8.8 (high) with network vector, low attack complexity, no privileges required, but user interaction required. It is triggered when a victim connects to an attacker-controlled WebDAV server — for example by clicking a webdav:// link or mounting an untrusted WebDAV share via Finder's 'Connect to Server' — and the malformed server responses corrupt memory in the WebDAV client code. Successful exploitation can yield arbitrary code execution with the privileges of the connecting user, impacting confidentiality, integrity, and availability. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27 are affected; Apple addressed the issue with improved validation. No public proof-of-concept is known and the flaw is not on the CISA KEV catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Patch to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (System Settings > Software Update), prioritizing fleets where users mount network shares. Advise users not to click webdav:// links or connect to WebDAV servers from untrusted sources, since the flaw requires user interaction. Egress/URL filtering can also block or flag webdav:// schemes and unexpected outbound WebDAV (TCP 80/443 with WebDAV methods) as a defense-in-depth measure.

Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.

Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.

CVE-2026-89013 is an authorization bypass vulnerability (CWE-863) in Dolibarr ERP/CRM that allows unauthenticated attackers to read arbitrary files from the server. An attacker sends a request to htdocs/document.php or htdocs/viewimage.php with the hashp parameter set to "shared", which skips token validation while still satisfying the authorization condition. Successful exploitation grants access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. All deployments running the affected version range (23.0.4 before 24.0.1) are impacted, particularly self-hosted instances reachable from the internet. No public proof-of-concept is known, the flaw is not in CISA KEV, and no confirmed in-the-wild exploitation has been reported.

Do: Upgrade to Dolibarr 24.0.1 or later, which fixes the bypass. As an interim mitigation, restrict or filter requests to document.php and viewimage.php at the reverse proxy/WAF layer, and review access logs for requests carrying hashp=shared. Because exposed database backups contain password hashes, consider rotating credentials if sensitive backups were reachable.

Dolibarr 24.0.0 before 24.0.1 is affected by a case-sensitivity flaw (CWE-178) in the sqlfilters parameter of its API: the denylist that hides protected database fields checks field names case-sensitively, while database column resolution is case-insensitive. An authenticated API user can supply uppercase variants of denylisted field names inside prefix-matching predicates, turning the query responses into a boolean oracle that leaks hidden fields. By repeatedly probing, the attacker can recover full password hashes for any user account, including administrator accounts. All deployments running Dolibarr 24.0.0 (or any affected 24.0.x release before 24.0.1) with the API exposed to authenticated users are affected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and there are no confirmed reports of exploitation in the wild.

Do: Upgrade Dolibarr to 24.0.1 or later. Until patched, restrict the REST API to trusted authenticated users and consider disabling or filtering use of the sqlfilters parameter; because the flaw can expose password hashes, ensure strong password hashing and be prepared to rotate credentials if API access was shared with untrusted parties.

PCRE2 before 10.48 contains an integer-overflow flaw (CWE-190) in the pcre2_pattern_convert function that leads to an out-of-bounds write, but only on 32-bit platforms and only when an attacker can supply a sufficiently large pattern. An application or service that compiles untrusted patterns on a 32-bit build is therefore exposed: successful corruption can modify memory outside the intended buffer, with the CVSS vector indicating high integrity impact and low availability impact but no confidentiality impact. Affected users are any products or deployments that ship or link a 32-bit build of PCRE2 older than 10.48 and pass attacker-controlled pattern data to the library; 64-bit deployments are not affected by this issue. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there are no confirmed reports of exploitation in the wild.

Do: Upgrade PCRE2 to version 10.48 or later, and rebuild or redeploy any application that statically or dynamically bundles an older 32-bit PCRE2 (check dependencies such as PHP, Exim, PostgreSQL or other software that embeds PCRE2 rather than relying on the system copy). Until patched, restrict or reject large attacker-supplied patterns on 32-bit builds to prevent the overflow condition. 64-bit deployments do not need immediate action for this flaw.

Docmost v0.21.0 contains a path traversal flaw (CWE-22) in its handling of avatar attachments. An unauthenticated attacker can send a crafted POST request to a publicly reachable URL, causing the application to read files from outside the intended directory on the server. Successful exploitation discloses arbitrary local files — potentially including configuration files, secrets, or environment variables — with no impact on integrity or availability (CVSS 3.1: 7.5, High, C:H/I:N/A:N). Any deployment running Docmost v0.21.0 is affected, with risk concentrated on instances exposed to the public internet. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so exploitation has not been confirmed, though the network-reachable, unauthenticated nature makes opportunistic scanning plausible once details circulate.

Do: Upgrade Docmost to a release newer than v0.21.0 as soon as a patched version is published, and watch the project's official GitHub repository or release notes for the fix. In the meantime, restrict network access to exposed instances (firewall rules, reverse-proxy allowlists, or VPN-only access) and inspect access logs for suspicious POST requests to avatar-attachment endpoints containing traversal sequences (e.g., ../) that indicate attempted file reads. Because the flaw only exposes files, prioritize identifying what sensitive data (credentials, keys) is stored on affected hosts in case compromise must be assumed.

Tesseract OCR 5.5.3 and earlier fails to validate counts read from the legacy INTTEMP component of .traineddata files: Classify::ReadIntTemplates uses NumClassPruners, NumClasses, and NumProtoSets as loop bounds without capping them against their maximums, and writes heap pointers past the fixed-capacity ClassPruners and ProtoSets arrays. An attacker who can supply or replace a .traineddata file consumed by Tesseract triggers this during legacy-classifier initialization, before any OCR output, gaining heap corruption, a crash (denial of service), or potentially controlled corruption. All deployments running Tesseract 5.5.3 or earlier are affected, particularly applications, document pipelines, and services that load traineddata files from untrusted or user-controlled sources. No fixed release is available as of this review, and no public proof-of-concept, KEV listing, or known in-the-wild exploitation exists.

Do: No patched version is available yet, so mitigate by ensuring Tesseract only loads .traineddata files from trusted sources and treat user-supplied traineddata as untrusted input. Deployments using only LSTM-based recognition can check whether their pipelines load legacy INTTEMP components, since the flaw is reached during legacy-classifier initialization. Monitor the tesseract-ocr GitHub repository for a fixed release and upgrade promptly once published.

knowns versions before 0.31.0 contain a path traversal flaw (CWE-73, External Control of File Name or Path) in the /api/opencode proxy endpoint, which fails to validate the x-opencode-directory request header. An unauthenticated remote attacker can send a crafted header containing arbitrary directory paths, causing the endpoint to perform file operations outside the intended project root on the host system. Depending on the permissions of the service process, this can allow reading, writing, or otherwise manipulating files anywhere on the host, which the critical 9.3 CVSS 4.0 score reflects with high ratings for confidentiality, integrity, and availability impact. Anyone running an affected version of knowns with the opencode proxy endpoint reachable over the network is affected. There are currently no reports of in-the-wild exploitation, no known public proof-of-concept, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

Do: Upgrade to knowns 0.31.0 or later, where the x-opencode-directory header is properly validated. If upgrading is not immediately possible, restrict network access to the /api/opencode endpoint (e.g., via reverse proxy rules), strip or validate the x-opencode-directory header, and run the service with least-privilege filesystem permissions. Administrators should also review host file integrity on exposed instances for signs of unexpected modifications.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.

Open WebUI rendered terminal port content in an iframe sandbox that combined both allow-scripts and allow-same-origin, which provides no effective isolation because the terminal proxy serves that content from the Open WebUI origin itself. An authenticated user with access to a shared terminal server can host malicious script on a previewed port, and when another user opens that preview the script executes in the Open WebUI origin. The attacker's script can then hijack the victim's session and act on their behalf, yielding account takeover with high impact to confidentiality and integrity. All Open WebUI deployments running version 0.8.11 up to (but not including) 0.11.1 are affected, primarily multi-user instances where a terminal server is shared among users. No public proof of concept is known and the issue is not in CISA KEV, so there is no confirmed exploitation in the wild to date.

Do: Upgrade to Open WebUI 0.11.1 or later, which removes the sandbox misconfiguration in the port preview. Until patched, restrict access to the shared terminal server to trusted users, discourage or disable the terminal port-preview feature for untrusted users, or serve terminal proxy content from a separate origin. Verify your currently deployed version and audit which accounts have access to the shared terminal server.

CVE-2026-73786 is a denial-of-service flaw in the web-based management interface of HPE Aruba ClearPass Policy Manager (CPPM), HPE's network access control (NAC) platform. An unauthenticated remote attacker can trigger it by sending malicious requests to the vulnerable management interface, with no credentials or user interaction required. Successful exploitation degrades performance and causes instability of the CPPM server, impacting availability only — there is no confidentiality or integrity impact per the CVSS vector. Organizations running affected CPPM deployments are in scope, though the affected version ranges are not specified in the available advisory data. Exploitation has not been observed: the flaw is not in CISA's KEV and no public proof-of-concept is known.

Do: Review whether your CPPM web management interface is reachable from untrusted networks and restrict access to trusted management networks or via VPN/firewall rules as an interim mitigation. Monitor the HPE-Aruba security advisory for the affected version ranges and patched releases (not included in this data) and apply the vendor update promptly once published, since no public PoC or in-the-wild exploitation is currently known.

CVE-2026-67401 is a critical SQL injection (CWE-89) in the EmailTrack component of cPanel, the widely used hosting control panel. An attacker holding any mail-enabled account on the server can reach the vulnerable component over the network with low privileges and no user interaction (CVSS: AV:N/AC:L/PR:L/UI:N), and the injection crosses a privilege boundary (Scope: Changed) to achieve remote code execution as root. Successful exploitation yields full compromise of the host — arbitrary commands as root with complete access to all hosted data — so every site, mailbox and account on an affected server is exposed. All cPanel deployments with mail enabled are potentially affected; the available data does not specify exact vulnerable version ranges, which are provided in WebPros security advisory AV26-908. Exploitation has not been confirmed in the wild (not in CISA KEV), but two public proof-of-concept exploits are already on GitHub, making near-term exploitation likely.

Do: Upgrade cPanel to the patched release identified in WebPros advisory AV26-908 (exact fixed version numbers are not given in the available data), prioritizing internet-facing servers that host mail-enabled accounts. Until patched, restrict access to the EmailTrack component and audit mail-enabled accounts and logs for suspicious database queries or unexpected root-level processes, since public PoC exploits are already available.

CVE-2026-79617 is an incorrect permission assignment for a critical resource (CWE-732) in the Pardus LightDM Greeter, the display-manager login component developed by TÜBİTAK BİLGEM for the Pardus Linux distribution. The flaw stems from incorrectly configured access controls, meaning a resource used by the greeter is not correctly permissioned; a local attacker with low privileges can trigger the issue without user interaction (AV:L/PR:L/UI:N). The high confidentiality and integrity impact (C:H/I:H) indicates the attacker can gain elevated, likely root-level, access on the local machine. Any system running Pardus LightDM Greeter before version 0.4.15 is affected, primarily Pardus desktop deployments. There is a public proof-of-concept reference (github.com/alpernae/CVE-2026-79617), but the issue is not yet in CISA KEV and no confirmed in-the-wild exploitation is reported.

Do: Upgrade Pardus LightDM Greeter to version 0.4.15 or later via the Pardus package repositories (apt update && apt upgrade). Verify the installed greeter package version on affected machines, prioritize shared or multi-user systems where unprivileged users have local access, and review the public PoC repository (github.com/alpernae/CVE-2026-79617) for details on which resource permissions to check if patching is delayed.

Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to its API middleware group and does not revoke a user's Passport personal access tokens when that user is deactivated (CWE-862). An attacker or former employee holding an existing API token for a deactivated account can therefore continue calling the REST API — reading and modifying assets, users, licenses, and other records — at the account's prior permission level until the token expires, even though web login is correctly blocked. If the deactivated account retains user-management permissions, it can even reactivate itself through the API, permanently undoing the deactivation control. All Snipe-IT deployments running a version before 8.7.0 in which deactivated users held issued API tokens are affected. There is no evidence of in-the-wild exploitation, no public proof-of-concept, and the issue is not in the CISA KEV catalog.

Do: Upgrade to Snipe-IT 8.7.0 or later. As an interim mitigation, manually revoke the Passport personal access tokens of any deactivated users (delete their oauth_access_tokens entries) and audit recently deactivated accounts for API activity, including unexpected self-reactivation or changes made at their former permission level.

GitPython before 3.1.60 fails to properly validate the location of the git directory, which lets an attacker impersonate it using tracked files such as gitdir, commondir, and HEAD. An attacker who can get a victim to clone or open a crafted repository can plant a malicious pre-commit hook in the tracked hooks directory. When the victim's code then calls index.commit() on that repository, the hook executes, giving the attacker arbitrary code execution with the privileges of the process running GitPython. Anyone running affected versions in workflows that process untrusted or attacker-influenced repositories — such as CI/CD pipelines, automation, and developer tooling — is affected, while purely local, fully trusted repository use is largely out of scope. No public proof-of-concept is known, the issue is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Upgrade GitPython to 3.1.60 or later. As interim mitigation, avoid calling index.commit() or other hook-triggering operations on repositories cloned from untrusted sources, and audit dependency trees and CI images for GitPython versions below 3.1.60. When reviewing untrusted repositories, look for tracked files named gitdir, commondir, or HEAD and unexpected files in a tracked hooks directory.

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

Do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.

CVE-2026-87528 is a type confusion flaw (CWE-843) in Rust-based code in Google Chrome on Windows. A remote attacker can trigger it by persuading a user to open a crafted HTML page, causing incorrect type handling in memory. Successful exploitation potentially allows execution of arbitrary code outside the browser sandbox, meaning an attacker's code would run beyond Chrome's renderer-level containment. Users running Google Chrome on Windows prior to 153.0.8010.36 are affected; no other products or platforms are named in the advisory. No in-the-wild exploitation is currently known: the flaw is not in CISA's KEV, EPSS assigns a 0.2% 30-day exploitation probability, and while the CVSS base score is 9.6 (critical), the Chromium project itself rates the issue Medium; one public reference (Chromium issue 539569491) exists.

Do: Update Google Chrome on Windows to 153.0.8010.36 or later, verifying the installed version at chrome://settings/help or chrome://version. No workaround that prevents the type confusion is documented, so prioritize patching, especially for users who browse untrusted web content; note the vendor severity is Medium but the flaw can yield code execution outside the sandbox. Technical details may emerge at Chromium issue 539569491, worth monitoring for indicators or exploit development.