Vulnerabilities

The CryptoPayment Gateway WordPress plugin versions 1.2.1 and 1.2.2 fails to enforce an authorization (capability) check on one of its AJAX endpoints, which means any unauthenticated visitor can invoke what should be administrative-only operations. An attacker triggers the flaw simply by sending a crafted request to the unprotected AJAX action — no valid session, nonce, or credentials are required. Successful abuse lets the attacker delete arbitrary files on the server (potentially destroying the site or enabling a WordPress reinstallation takeover by wiping wp-config.php), overwrite the payment gateway configuration, and retrieve stored wallet credentials in cleartext, which could lead to direct theft of cryptocurrency funds. Sites running the plugin at versions 1.2.1–1.2.2 are affected regardless of configuration. There is no known public PoC and no evidence of in-the-wild exploitation to date, though the CVSS 10.0 rating and trivial preconditions make patching urgent.

Do: Update the CryptoPayment Gateway plugin immediately to the latest version (anything after 1.2.2, per the advisory's fixed-range). Treat all wallet credentials and API keys handled by the plugin as compromised: rotate wallets/seed phrases, review the gateway configuration for unauthorized changes, and verify site files for unexpected deletions or modifications (including restoring from backup if wp-config.php was targeted). Until patched, block unauthenticated AJAX requests to the plugin's endpoints via WAF rules or disable the plugin.

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

The WP Component WordPress plugin through version 2.2.4 exposes an action to unauthenticated users that has no capability or nonce checks, and it takes both the option name and the option value directly from the request. This allows any unauthenticated attacker to overwrite arbitrary WordPress site options by sending a single crafted HTTP request. On single-site installations this leads to a full takeover, since the attacker can enable user registration with a default role of administrator and then create an administrator account. Any site running the plugin at or including version 2.2.4 is affected, and the advisory does not specify a fixed version. There is no known public proof of concept, no evidence of in-the-wild exploitation, and the CVE is not on CISA's KEV list.

Do: Upgrade WP Component to a version later than 2.2.4 as soon as a patched release is available, or remove the plugin entirely if no fix is forthcoming. Inspect the site's options for tampering — particularly 'users_can_register' enabled and 'default_role' set to administrator — and audit the users list for unauthorized administrator accounts. Review access logs for unauthenticated POST requests hitting the plugin's option-writing action endpoint.

The piclect WordPress plugin through version 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory. An unauthenticated attacker can simply send a crafted file (for example, a PHP webshell) to the plugin's upload endpoint and then reach it via its public URL, achieving arbitrary code execution and full server compromise. Any site running piclect through 1.0 with the plugin active is affected, and the flaw requires no authentication, user interaction, or privileges (CVSS 9.8). There is no known public PoC and the issue is not in the CISA KEV catalog, so exploitation status is currently none known, though the attack itself is trivial to reproduce. Defenders should treat any site running this plugin as potentially compromised.

Do: There is no indicated patched version, so remove or disable the piclect plugin entirely until a fixed release is available. Immediately inspect the plugin's public upload directory and the webserver for unexpected files (especially .php or .phtml shells) and rotate credentials/keys if any are found. As an interim control, block unauthenticated POST requests to the plugin's upload endpoint at the WAF or reverse proxy.

The Masteriyo LMS WordPress plugin before 3.4.1 deserializes user-supplied metadata without validation when it is read back (CWE-502), enabling classic PHP object injection. An attacker holding even a minimal WordPress account (for example a subscriber created through open registration) can inject arbitrary PHP objects and, by abusing a gadget class bundled with the plugin's libraries, write and execute arbitrary code on the server. A weaker unauthenticated variant of the same flaw lets attackers with no account at all perform an arbitrary file write. The issue is rated critical at CVSS 3.1 9.9 with high impact on confidentiality, integrity, and availability, and affects all installations running versions before 3.4.1. The flaw was assigned via WPScan; no public proof of concept or in-the-wild exploitation is currently known.

Do: Upgrade Masteriyo LMS to version 3.4.1 or later immediately, since both the authenticated RCE and the unauthenticated file-write paths are fixed there. If your site allows open self-registration, review recently created low-privilege (subscriber) accounts for suspicious signups and consider temporarily disabling registration. Audit the server for unexpected files under the web root, webshells, or newly added administrator users, and verify the integrity of wp-content and your backups.

The DS Ad Rotator WordPress plugin through version 0.8 exposes an image upload handler that performs no capability check, nonce verification, or file-type validation. Any unauthenticated attacker can send a crafted upload request directly to the vulnerable endpoint and write arbitrary files — including PHP scripts — into a web-accessible directory, where they can be executed to obtain remote code execution. Successful exploitation gives the attacker full control of the affected site and its underlying server, including data theft, defacement, and further pivoting. All sites running DS Ad Rotator 0.8 or earlier are affected, and no fixed version has been released. No public proof of concept is known and the flaw is not on CISA's KEV list, but exploitation is trivial for anyone who locates the endpoint, so exposure should be treated as immediately dangerous.

Do: No patched release exists (every version through 0.8 is vulnerable), so deactivate and delete DS Ad Rotator and replace it with a maintained ad-rotation plugin. In the interim, block or restrict access to the plugin's upload endpoint via a WAF or web-server rule. Audit the plugin's upload directory and the site for unexpected .php files or recently modified files that could indicate a planted webshell; if any are found, assume full compromise and rotate all credentials, database keys, and salts.

The WebTotem Backups WordPress plugin through version 1.0.1 contains a chained flaw in its file-deletion function: it does not validate the user-supplied file path, does not verify the requesting user's capabilities, and discards the result of its own CSRF check. As a result, any authenticated user — even a low-privilege role such as subscriber — can submit the plugin's request with a crafted path and delete arbitrary files on the web server. Arbitrary file deletion on WordPress can enable full site takeover, for example by deleting wp-config.php to force the site back into its installation routine and reclaim it. All sites running the plugin through version 1.0.1 are affected. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no indication of active exploitation.

Do: Update the plugin if a release newer than 1.0.1 is available; if no fixed version exists, deactivate and delete WebTotem Backups and switch to an alternative backup solution. Audit file systems and logs for unexplained deletions — particularly wp-config.php, .htaccess, and index.php — and check whether the site was forced into a reinstall or otherwise tampered with. Additionally, review subscriber and other low-privilege accounts for unauthorized registrations, and consider a WAF rule blocking the plugin's file-deletion endpoint.

The CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1 deletes a user-supplied file without validating the path or checking the requesting user's capabilities (CWE-73). This means any authenticated user — even a low-privileged subscriber — can supply a crafted file path, including paths outside the plugin's intended directory, and delete arbitrary files on the server. By removing critical files such as wp-config.php or .htaccess, an attacker can trigger a WordPress reinstallation/reconfiguration flow and ultimately take over the site, reflecting the critical 9.6 CVSS score with high integrity and availability impact. Sites running the plugin at or below 1.0.1, especially those with open registration or many subscriber-level accounts, are the most exposed. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

Do: Update to a version newer than 1.0.1 if the developer has released a fix; if no patched version exists, deactivate and delete the plugin. Restrict self-registration and review user lists for unexpected subscriber accounts, and verify server integrity by checking for missing or tampered core files (e.g., wp-config.php, index.php, .htaccess), restoring from a clean backup if any are found.

The Frontegg SAML SSO WordPress plugin through version 1.0.1 does not verify the cryptographic signature or issuer of SAML authentication responses before establishing a login session (CWE-287, improper authentication). An unauthenticated remote attacker can craft a forged SAML response for the target site and submit it to the plugin's SSO endpoint, which accepts it without any validation. This lets the attacker log in as any existing user — including administrators — and create arbitrary new accounts, resulting in complete site takeover (CVSS 3.1: 9.8, critical). Any WordPress site running this plugin at version 1.0.1 or earlier with SAML SSO in use is affected. No public proof of concept is known, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

Do: Upgrade to a patched release above 1.0.1 as soon as one is available (monitor WPScan and the WordPress.org plugin page); until then, disable or remove the plugin and use an alternative SAML SSO solution, or restrict access to the plugin's SAML assertion endpoint at the firewall/WAF. Inspect user lists and authentication logs for unexpected accounts or admin logins, delete any rogue accounts, and reset credentials for all privileged users.

CVE-2026-62105 is an unauthenticated PHP object injection flaw (CWE-502, deserialization of untrusted data) in the ThemeREX Addons plugin for WordPress, affecting all versions below 2.45.0. Because the vulnerable deserialization path is reachable over the network without authentication, privileges, or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N), any remote attacker can send a crafted serialized PHP payload to trigger it. Successful object injection can leverage PHP object chains in WordPress for high-impact outcomes such as arbitrary code execution, database manipulation, or file operations (CVSS 3.1 C:H/I:H/A:H), potentially leading to full site compromise. WordPress sites running ThemeREX Addons prior to 2.45.0 are affected, including sites where the plugin was installed automatically as a companion to a ThemeREX commercial theme rather than chosen by the site owner. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Update ThemeREX Addons to version 2.45.0 or later, checking the plugin list even on sites where it was installed automatically with a bundled ThemeREX theme. If immediate patching is not possible, apply WAF rules that restrict unauthenticated requests to the plugin's endpoints and review logs for unexpected admin users, modified files, or unusual serialized input. No public PoC or known exploitation is currently reported, but treat this critical (9.8) issue as a priority patch.

CVE-2026-62103 is an unauthenticated PHP object injection vulnerability in the Everest Forms WordPress plugin, caused by deserialization of untrusted data (CWE-502). An attacker who can reach the affected code path without logging in can supply crafted serialized values, causing the plugin to instantiate arbitrary PHP objects. Depending on the object classes (gadget chains) present in a site's installed plugins, this can escalate to arbitrary file deletion, data modification, and potentially remote code execution, consistent with the assigned critical 9.8 CVSS score. All WordPress sites running Everest Forms version 3.6.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there is no confirmed exploitation in the wild at this time.

Do: Update Everest Forms to the latest available release (any version above 3.6.0) on all WordPress sites, prioritizing internet-facing sites given the unauthenticated, network-exploitable nature of the flaw. If patching must be delayed, deactivate the plugin as a stopgap and review web server and WordPress logs for suspicious unauthenticated requests or signs of object-injection abuse.

The advanced-customized-prompts WordPress plugin through version 1.0.1 fails to verify the password before issuing an authenticated session for a supplied email address via an unauthenticated action, an improper authentication flaw (CWE-287). An unauthenticated remote attacker can trigger this by submitting any registered user's email address to the affected endpoint and receive a valid logged-in session without ever knowing the password, or can create arbitrary new accounts. This grants full control of the impersonated account, including administrator accounts, potentially leading to complete site takeover. Any WordPress site running the plugin at version 1.0.1 or earlier is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA KEV.

Do: Deactivate or remove the advanced-customized-prompts plugin until a patched release newer than 1.0.1 is published, then update to the latest fixed version. Audit WordPress user accounts and authentication logs for unexpected admin sessions or newly created accounts, and rotate credentials for privileged users as a precaution.

CVE-2026-14560 is an unauthenticated arbitrary file upload flaw in the teddy-bear-customize-addon WordPress plugin (all versions through 1.0.5) that leads to remote code execution, classified as CWE-94 code injection. The plugin fails to validate uploads server-side, trusting the client-supplied content type and preserving the attacker's original filename, so an unauthenticated attacker can upload a file such as a PHP web shell directly to the server. When the uploaded PHP file is requested over the web, the attacker executes arbitrary code with the privileges of the web server, enabling full site compromise and potential lateral movement on shared hosting. Any WordPress installation running the plugin through 1.0.5 is affected; exposure is limited to sites using this niche customization addon. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time, but the trivially exploitable network vector (CVSS 10.0) makes opportunistic scanning likely.

Do: Update the teddy-bear-customize-addon plugin to the latest available version as soon as a patched release is published (all versions through 1.0.5 are vulnerable); if no fix is available yet, deactivate or remove the plugin. Audit the uploads directory for unexpected .php files and review access logs for unauthenticated POST requests to the upload endpoint to detect any compromise. As a stopgap, block direct execution of PHP files in the uploads directory or apply WAF rules requiring server-side validation of upload types.

CVE-2026-14559 is a critical authentication flaw (CWE-287) in the teddy-bear-customize-addon WordPress plugin, which authenticates users without verifying their password. An unauthenticated attacker who knows or guesses a registered user's email address can authenticate as that user through the plugin's login flow with no password required. Because the impersonated accounts include administrators, an attacker gains full control of the WordPress site, including the ability to install plugins or themes, edit files, and create new admin users for persistence. Any WordPress site running the plugin at version 1.0.5 or earlier is affected; the flaw requires no privileges or user interaction and is trivially exploitable over the network (CVSS 3.1: 9.8). No public proof-of-concept is known, the issue is not in CISA's KEV, and no in-the-wild exploitation has been documented as of this analysis.

Do: Deactivate or remove the teddy-bear-customize-addon plugin until a patched release beyond 1.0.5 is available, then update immediately, as no fixed version is documented in the data. Review authentication logs for administrator sign-ins without corresponding password activity, and rotate or reset credentials for privileged accounts if any suspicious logins are found. As an interim mitigation, a WAF rule or enforced password check on the plugin's login path can block the bypass.

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress is affected by an unrestricted file-upload flaw (CWE-434): the mipl_wc_upload_file function performs no file-type validation in all versions up to and including 1.2.1. An unauthenticated, remote attacker can trigger the flaw by submitting a crafted upload request over the network, with no authentication or user interaction required (CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N). By uploading arbitrary files — for example a PHP script — to a web-executable location, the attacker may achieve remote code execution and compromise the site, matching the high confidentiality, integrity, and availability impact reflected in the critical 9.8 score. Any WordPress site, typically a WooCommerce store, running the plugin at version 1.2.1 or older is affected. As of the available data there is no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Do: Update the plugin to the first available release newer than 1.2.1 once a patched version is published (no fixed version number is stated in the available data), or deactivate the plugin until a fix ships. As an interim mitigation, deny PHP execution in the upload destination used by the plugin (typically under wp-content/uploads) via web-server rules so uploaded files cannot run. Because the flaw is exploitable by unauthenticated users on internet-facing stores, check the uploads directory for unexpected PHP or other unfamiliar files and review web-server logs for unauthenticated POST requests to the plugin's upload endpoint.

CVE-2026-81800 is an unauthenticated SQL injection flaw (CWE-89) in the Verified Reviews (Avis Vérifiés) WordPress plugin, affecting all versions up to and including 2.4.6. Because the vulnerable code path requires no authentication (CVSS AV:N/PR:N/UI:N), a remote attacker can send crafted input — for example, a parameter handled by the plugin in a database query — and inject malicious SQL into the site's database. The published CVSS (C:H, I:N, A:L, scope changed) indicates the primary impact is high-confidentiality disclosure of database contents, with limited availability impact and no direct integrity impact; in practice this could expose data such as plugin-managed review/order data, WordPress user records and password hashes, and other tables in the database. Any WordPress site running the plugin at version 2.4.6 or earlier is affected. The issue was disclosed through Patchstack (the assigned CNA); it is not in CISA's KEV catalog and no public proof-of-concept or confirmed in-the-wild exploitation is currently known.

Do: Update the Verified Reviews (Avis Vérifiés) plugin on every affected site to the latest patched release (any version above 2.4.6, e.g., 2.4.7 or later once published). Until patched, consider deactivating the plugin or applying WAF rules that block SQL-injection patterns against the plugin's endpoints, and review web logs for suspicious unauthenticated requests to plugin routes. Since no public PoC exists, prioritize internet-exposed WordPress sites running the plugin.

CVE-2026-78361 is a critical missing-authorization flaw (CWE-862) in the zipMoney (Zip Co) Payments Plugin for WooCommerce, a WordPress payment gateway plugin. The plugin's front-end request handler performs no authorization checks and does not restrict which option name a caller may supply, so any unauthenticated visitor can send a crafted request that deletes an arbitrary WordPress option. By targeting key options such as the site URL or the list of active plugins, an attacker can destroy site and access-control configuration, deactivate every installed plugin, and take the site offline; the impact is limited to integrity and availability, with no confidentiality loss. Only WordPress sites running the plugin in a version prior to 2.4.0 are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

Do: Update the plugin to version 2.4.0 or later. As an interim measure, block unauthenticated requests reaching the plugin's front-end handler (for example with WAF rules on the relevant action and option-name parameters) and confirm that critical options such as the site URL, home URL, and active-plugins list have not been deleted. Operators who notice unexpected site downtime or mass plugin deactivation should check for evidence of this option-deletion request pattern.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.

Frontend Admin by DynamiApps, a WordPress plugin for building frontend forms and user-profile editing, contains an authentication-bypass flaw that enables unauthenticated account takeover (CVE-2026-75816). The pre_update_value function performs no capability or ownership check, and ActionPost::conditions_logic() skips its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric (e.g., the string user_1), so unauthenticated form submissions can be routed to arbitrary user records without restriction. An attacker can therefore overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account. Any WordPress site running the plugin in versions up to and including 3.29.12 is affected. No public proof of concept is known and the issue is not in CISA's KEV; EPSS currently estimates a roughly 0.5% probability of exploitation within 30 days.

Do: Update Frontend Admin to a patched release newer than 3.29.12 as soon as one is available. Until patched, temporarily deactivate the plugin or restrict its public form submissions, then verify that no administrator (or other) accounts had their email address changed unexpectedly and review for unrecognized password resets. Monitor for public exploits, as a critical 9.8-rated flaw like this can draw rapid attack activity once a PoC appears.

The MemberDash WordPress plugin (all versions through 1.8.5) contains an Insecure Direct Object Reference (CWE-639) in a registration flow, where a user-controlled 'id' parameter is accepted without validating that it belongs to the acting user. Because the endpoint requires no authentication or capability check, an unauthenticated attacker can submit an arbitrary WordPress user ID, including that of an administrator, and trigger a password change for that account. An attacker who does this can then log in with the new password and gain full control of an administrator account, effectively compromising the site; the legitimate owner receives no notification or email about the change. Any WordPress site running MemberDash 1.8.5 or earlier with user registration enabled is affected. Exploitation has not yet been reported in the wild, no public proof-of-concept is known, and CISA has not added the issue to its KEV catalog, though the critical CVSS 9.8 score indicates a low attack barrier.

Do: Update MemberDash to the latest patched release (anything newer than 1.8.5); no fixed version number is provided in the source data, so verify the changelog before deploying. As interim mitigation, restrict or disable open user registration or block access to the affected registration endpoint at the WAF level. Because password changes occur without notification, audit user accounts—especially administrators—for unexpected password changes or unfamiliar login activity on sites that ran a vulnerable version.

The Mail Mint WordPress plugin (email marketing, newsletter, and automation) deserializes untrusted input in its 'handle_form_submission' function without adequate validation, enabling unauthenticated attackers to inject a PHP object. Because the form-submission handler requires no authentication or privileges, any visitor able to reach a Mail Mint form can trigger the flaw. By supplying a crafted serialized object, an attacker can exploit an available POP chain to execute code on the server, potentially leading to full site compromise (CVSS 9.8). All versions through 1.31.0 are affected; the fix in 1.23.1 was only partial, so sites running even partially patched releases remain exposed. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS assigns a 0.6% probability of exploitation within 30 days, indicating no confirmed in-the-wild exploitation yet.

Do: Update Mail Mint to the first available release after 1.31.0, since 1.23.1 was only a partial fix and should not be relied upon. Until a fully patched release is applied, deactivate the plugin or restrict access to its form submission endpoints, and consider WAF rules blocking serialized-object (O:) patterns in form POSTs. No public PoC is known, but the flaw is unauthenticated and trivially triggerable wherever forms are exposed, so treat patching as high priority.

CVE-2024-11080 is an unauthenticated hook injection flaw (CWE-94) in the Post Grid and Gutenberg Blocks - ComboBlocks WordPress plugin, affecting versions 2.2.32 through 2.3.1. The vulnerable functions in the includes/blocks/form-wrap/function.php file can be reached over the network without authentication, allowing an attacker to invoke WordPress hook functions with arbitrary hooks, provided no other security controls are present in the function. Successful abuse lets the attacker trigger actions registered for those hooks, with impact ranging from content or data manipulation to code execution or privilege changes depending on which hooks and handlers a given site exposes; the 9.8 CVSS score reflects high confidentiality, integrity, and availability impact potential. Any WordPress site running the plugin in versions 2.2.32 through 2.3.1 is affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only about a 0.4% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known.

Do: Update the ComboBlocks plugin to the latest available release (any version above 2.3.1) and confirm the installed version on the WordPress Plugins page. Until updating, consider blocking unauthenticated requests to the plugin's form-related endpoints via WAF rules and review the site for unexpected content changes, new users, or modified settings. Since impact depends on which hooks are exposed on each site, check installed plugins/themes for handlers reachable by unauthenticated callers.

SEO Flow by LupsOnline, a WordPress SEO plugin, does not correctly validate the credential supplied with its API requests, so unauthenticated requests are served as the administrator who configured the plugin (CWE-269, improper privilege management). Any unauthenticated attacker who can reach the plugin's API endpoints on a site where the plugin has been configured — its normal operating state — can exploit this with no credentials and no user interaction. Successful exploitation yields administrator-level access to the WordPress site, enabling complete takeover, consistent with the critical 9.8 CVSS score with high confidentiality, integrity, and availability impact. WordPress sites running SEO Flow by LupsOnline versions before 3.0.3 are affected. Exploitation has not been confirmed: no public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

Do: Upgrade to SEO Flow by LupsOnline 3.0.3 or later, the fixed version. Until patched, restrict or block unauthenticated access to the plugin's API endpoints at the web-application-firewall or web-server layer and monitor logs for requests to those endpoints. Because exploitation grants administrator-level access, also review the site for unexpected admin activity, new admin accounts, or unauthorized content/plugin changes.

CVE-2026-83627 is a critical, unauthenticated remote code execution flaw in the Hummingbird speed-optimization plugin for WordPress, affecting all versions up to and including 3.21.0. The page-cache debug log is written to the directly web-accessible file wp-content/wphb-logs/page-caching-log.php, whose protective '<?php die(); ?>' header is guarded by a class_exists('Filesystem') check that can never match (the class actually lives in Hummingbird\Core), so the header is omitted whenever the log is created during a front-end request — via the plugin's Clear logs action, a cache flush, or unattended through the daily log-rotation cron — and get_cookies() then writes raw wphb_cache_-prefixed cookie names into the file without sanitization. An unauthenticated attacker can therefore send a single anonymous request with malicious PHP in a wphb_cache_ cookie and execute it by loading the log file directly, gaining full remote code execution under the web server's account. Only sites where an administrator enabled Page Caching together with the non-default Debug Log option are exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently assigns a 0.8% probability of exploitation within 30 days, and the issue is not in the CISA KEV catalog.

Do: Update the Hummingbird plugin to the first fixed release (any version newer than 3.21.0) as soon as possible; until then, disable the Page Caching Debug Log option and delete or block direct web access to wp-content/wphb-logs/page-caching-log.php. Inspect the log file for injected PHP (e.g., content following unexpected wphb_cache_ cookie names) and review web-server access logs for anonymous requests to that path, since successful exploitation grants code execution under the web-server account and can lead to full site compromise.

The Mstore Api plugin for WordPress (versions up to and including 4.20.0) fails to cryptographically verify Firebase Phone Auth JWTs: its FirebasePhoneAuthHelper::verify_id_token() function checks token claims (alg, kid, aud, iss) but never validates the signature against Google's public key certificates. An unauthenticated attacker can therefore forge a token signed with their own self-generated RSA key pair and submit it to the plugin's authentication flow. Successful forgery lets the attacker impersonate any phone number, gaining access to existing WordPress accounts linked to known phone numbers or creating new arbitrary accounts, potentially with elevated roles. Any WordPress site running the Mstore Api plugin at or below version 4.20.0 is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently puts 30-day exploitation probability at about 0.4%.

Do: Sites running Mstore Api 4.20.0 or earlier should update to a fixed release beyond 4.20.0 as soon as one is published (no fixed version is specified in the available data), and should monitor the plugin changelog. As an interim mitigation, deactivate the plugin or restrict access to its Firebase phone-authentication REST endpoints (e.g., at the web server/WAF level) until patched. Review recent user registrations and logins associated with phone-number-based authentication for signs of forged tokens or unauthorized accounts.

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 performs no authorisation or nonce checks on its REST API routes (CWE-862), so any unauthenticated visitor can invoke those endpoints. An attacker can install and activate arbitrary plugins and themes, import content from a URL under their control, write an attacker-chosen file into the uploads directory, and delete existing site content and media. On hosts that execute PHP files stored in the uploads directory, that arbitrary file write escalates to full remote code execution; even where PHP is not executed in uploads, the attacker can establish persistence via an installed plugin/theme or vandalise the site. Any WordPress site running version 1.0.0 of this plugin is affected, and the flaw is rated critical (CVSS 3.1: 9.8); the plugin's GitHub-build distribution suggests a limited but unquantified installed base. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS estimates a 0.6% probability of exploitation within 30 days (45th percentile).

Do: Deactivate or remove the plugin, or update to the latest patched release from its GitHub source as soon as one is published (only 1.0.0 is documented as vulnerable, so no fixed version number is available in this data). As interim mitigations, disable PHP execution in wp-content/uploads and restrict unauthenticated access to the plugin's WordPress REST API routes (e.g., via WAF rules). Check sites for signs of compromise, including unexpectedly installed or activated plugins/themes, unknown files in the uploads directory, and deleted posts or media.

ACPT (Premium), a WordPress plugin for building custom post types and front-end forms, contains a privilege escalation flaw in all versions up to and including 2.0.66, caused by missing authorization checks in the submit() function. Because unauthenticated form submissions can control the target user ID passed to wp_update_user(), any visitor able to reach a public ACPT user form that allows anonymous submissions can supply an arbitrary user ID. An attacker can thereby overwrite the email address and password of any WordPress user, including an administrator, and take over the account. Only sites running the affected premium plugin and exposing a public, anonymous-permitted ACPT user form are vulnerable. No public proof-of-concept or confirmed exploitation is known; EPSS is 0.3% (22nd percentile) and the issue is not in CISA's KEV.

Do: Update ACPT Premium to the latest patched release (anything above 2.0.66) as soon as one is available. Until patched, restrict or remove public ACPT user forms that permit anonymous submissions, or place them behind authentication. Also review administrator (and other) accounts for unexpected changes to email addresses or passwords, which would indicate exploitation.

CVE-2026-11613 is a local file inclusion (CWE-98) in the Divi Ajax Filter plugin for WordPress, exploitable in all versions up to and including 5.1.2 through the 'custom_loop_template' parameter. The flaw can only be triggered when the plugin's 'loop_templates' parameter is set to 'custom-template'; in that configuration, an unauthenticated attacker can reach the vulnerable parameter over the network and cause the server to include an arbitrary .php file. Successful inclusion executes any PHP code contained in the chosen file, which an attacker can use to bypass access controls, read sensitive data, or gain full code execution if they can also upload a .php file that is then included. Any WordPress site running Divi Ajax Filter 5.1.2 or older with the custom-template loop setting enabled is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and the EPSS estimate puts 30-day exploitation probability at 0.5% (38th percentile).

Do: Update Divi Ajax Filter to the latest release, which supersedes 5.1.2, as soon as a patched version is published. Sites that cannot update should disable or avoid the 'custom-template' loop_templates configuration, since the flaw is only exploitable in that mode, and consider WAF rules that block unauthenticated requests supplying the 'custom_loop_template' parameter. Administrators should also audit uploads for attacker-placed .php files and check logs for unexpected local file inclusion activity.

CVE-2026-84834 is an unauthenticated PHP object injection flaw (CWE-502) in the JobSearch job-board plugin for WordPress. An attacker with no account or privileges can submit crafted serialized PHP data to an affected plugin parameter or endpoint, which the plugin unserializes without validation. Successful injection can, depending on available gadget chains in the plugin and WordPress environment, lead to code execution, data manipulation, or other site compromise; the assigned CVSS 3.1 score of 9.8 reflects potentially high impact on confidentiality, integrity, and availability. Any WordPress site running JobSearch version 3.2.0 or earlier is affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only about a 0.3% chance of exploitation in the next 30 days.

Do: Update the JobSearch plugin to the latest release available from the developer, i.e., any version newer than 3.2.0. As an interim mitigation, apply WAF rules blocking untrusted serialized PHP input to plugin parameters and review logs for anomalous serialized payloads. Because no public PoC exists, prioritize patching internet-facing job-board sites where anonymous access is enabled.

Bricksforge, a companion plugin for the Bricks Builder WordPress theme, mishandles user privilege assignment (CWE-266), allowing accounts at the lowest subscriber tier to escalate to higher-privileged roles. The flaw is reachable over the network, and the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the trigger requires no special conditions or user interaction, per the vulnerability description originating from subscriber-level access. An attacker who escalates gains elevated capabilities on the affected WordPress site, with the assigned vector scoring high impact for confidentiality, integrity, and availability (9.8 critical). Any WordPress site running Bricksforge version 3.1.8.8 or earlier is affected. As of now there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days, so no active exploitation is known.

Do: Update Bricksforge to a version later than 3.1.8.8 as soon as the vendor publishes a patched release, or deactivate the plugin until a fix is available. As interim mitigation, restrict or disable open subscriber registration and audit existing user accounts for unexpected role changes. There is no public PoC or KEV listing, but treat exposed WordPress sites as priority candidates for patching given the critical 9.8 CVSS score.

GeoDirectory versions up to and including 2.8.174 contain an unauthenticated SQL injection flaw (CWE-89) in which attacker-controlled input reaches a database query without proper sanitization. Because the flaw is reachable over the network without authentication or user interaction, an unauthenticated attacker can send crafted requests to trigger it. Successful exploitation primarily exposes database contents (high confidentiality impact, per the CVSS score), with only limited availability impact and no direct integrity impact; exposed data could include directory listings and other site data stored in the WordPress database. Any WordPress site running GeoDirectory 2.8.174 or earlier is affected. Exploitation has not been confirmed: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at only about 0.2%.

Do: Update GeoDirectory to the latest release (any version newer than 2.8.174) as soon as possible, since no authentication is required for exploitation. Until patched, sites should check access logs for suspicious requests hitting directory/search parameters and consider applying a WAF rule that blocks common SQL injection patterns.

VikAppointments Services Booking Calendar, a WordPress appointment-booking plugin, is vulnerable to an unauthenticated SQL injection (CWE-89) in all versions up to and including 1.2.20. Because the flaw requires no authentication and is reachable over the network, any remote attacker who can reach the affected site can submit crafted input to the vulnerable request and inject SQL into the plugin's database queries. Per the CVSS vector, successful exploitation primarily exposes confidential database contents (confidentiality: high, integrity: none, availability: low), potentially including booking and customer records. Any WordPress site running the plugin at version 1.2.20 or earlier is affected; this is a niche booking plugin, so the plausible install base is in the low thousands of sites rather than millions. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns only about 0.2% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is documented at this time.

Do: Update VikAppointments Services Booking Calendar to a version newer than 1.2.20 as soon as a patched release is available, and verify the installed version on every managed site. If updating must wait, consider temporarily deactivating the plugin since the flaw is exploitable without authentication, and review web-server logs for suspicious SQL-error or injection-pattern requests against the site. Because confidentiality is the primary impact, consider auditing the WordPress database (booking/customer tables) for signs of unauthorized reads if compromise is suspected.

CVE-2026-84753 is a critical (CVSS 9.8) unauthenticated PHP object injection flaw — insecure deserialization of untrusted data (CWE-502) — in Mail Mint, a WordPress email marketing and CRM automation plugin. An unauthenticated remote attacker can supply crafted serialized input that the plugin deserializes without validation, injecting attacker-controlled PHP objects into the application. Depending on the object classes available in the affected WordPress environment, this can lead to high-impact outcomes such as remote code execution, unauthorized data access, or data tampering, consistent with the high confidentiality, integrity, and impact scores. Any WordPress site running Mail Mint version 1.31.0 or earlier is affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation within 30 days, so it is not currently known to be exploited in the wild.

Do: Update Mail Mint to the latest patched release (anything newer than 1.31.0; the fixed version is not specified in the available data, so check the plugin's changelog on WordPress.org). Sites that cannot update immediately should consider temporarily deactivating the plugin or limiting unauthenticated access to it, and defenders should monitor for a public PoC or KEV addition given the critical rating.

YITH Request a Quote for WooCommerce Premium, in versions before 4.46.0, contains an unauthenticated broken access control flaw classified as CWE-862 (Missing Authorization), meaning functionality that should verify a user's permissions performs no authorization check at all. Because no credentials are required, any remote attacker can trigger the affected functionality directly over the network with no user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). The critical 9.8 rating, with high impact to confidentiality, integrity, and availability, indicates an attacker can access protected functionality and data as if authorized, exposing or manipulating sensitive quote and store information. All deployments of the Premium edition prior to 4.46.0 are affected; the free edition is not named in the advisory. There is currently no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS puts 30-day exploitation probability at just 0.3% (19th percentile), so no in-the-wild exploitation is documented.

Do: Upgrade YITH Request a Quote for WooCommerce Premium to version 4.46.0 or later, and confirm the installed version on the WordPress plugins screen. Since the flaw is exploitable without credentials and no public PoC exists, a WAF rule restricting unauthenticated access to the plugin's endpoints is a reasonable interim measure while patching. No other mitigations are documented in the available advisory data.

WatchMan-Site7, a WordPress site-monitoring plugin, exposes a debugging console through version 4.2.0 that is not access-restricted and executes user-supplied PHP code. Any authenticated account, even a low-privileged subscriber, can reach the console over the network and have arbitrary PHP executed on the web server. Successful exploitation yields full remote code execution with high impact to confidentiality, integrity, and availability, potentially compromising the entire site and its hosting environment (the CVSS score reflects scope change beyond the plugin). Any WordPress installation running WatchMan-Site7 4.2.0 or earlier is affected, with elevated risk on sites that allow open registration, since attackers can self-register as subscribers. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and the EPSS score (0.3%, 21st percentile) indicates a low probability of exploitation in the next 30 days.

Do: Update WatchMan-Site7 to the newest release above 4.2.0 as soon as a patched version is available on wordpress.org, or deactivate the plugin until then. As an interim measure, block or restrict access to the plugin's debugging console (e.g., via WAF rules) and review whether open registration allows strangers to obtain subscriber accounts. Check web-server and WordPress logs for unexplained PHP execution, modified files, or unusual authenticated requests to the console.

The Embed HTML5 Game WordPress plugin through version 1.3 fails to properly restrict who can upload files through the plugin and what file types are permitted, creating an unauthenticated unrestricted file upload flaw (CWE-434). An attacker can trigger the flaw by sending a crafted upload request to the plugin's upload functionality on a vulnerable WordPress site without any account or privileges. Because uploaded files are not type-restricted, the attacker can plant a PHP backdoor or web shell on the server and request it, achieving remote code execution with full impact on confidentiality, integrity, and availability. Any WordPress site running Embed HTML5 Game version 1.3 or earlier is affected. As of now there is no known public proof of concept, no entry in the CISA KEV catalog, and no confirmed exploitation in the wild, with EPSS estimating only a 0.3% probability of exploitation in the next 30 days.

Do: Update the Embed HTML5 Game plugin to a version newer than 1.3 as soon as a patched release is available, or deactivate the plugin until an update can be applied. In the interim, block or restrict unauthenticated access to the plugin's upload endpoint and audit the site's uploads directories for unexpected PHP files that may indicate a backdoor was already planted. Given the critical (CVSS 10) severity, prioritize this check on all sites where the plugin is active.

CVE-2025-9314 is an unauthenticated arbitrary file upload flaw (CWE-434) in the SWFUpload component bundled with the Developer Tools WordPress plugin, affecting all versions through 1.1.3. An unauthenticated attacker can send crafted requests to the plugin's SWFUpload upload handler to write attacker-controlled files, such as PHP scripts, to the web server without any credentials. Because uploaded files land in web-accessible storage, this can lead to remote code execution and full site compromise, consistent with the 9.8 (critical) CVSS score. Any WordPress site running Developer Tools 1.1.3 or earlier is affected. There is currently no public proof of concept, the issue is not in CISA's KEV, and EPSS is 0.3% (22nd percentile), so no exploitation has been reported.

Do: Update the Developer Tools plugin to the latest release as soon as a version newer than 1.1.3 is available; if no patched release exists, deactivate or remove the plugin until a fix ships. As hardening, block direct PHP execution in wp-content/uploads and other writable paths, and review those directories for unexpected PHP or web-shell files left by prior uploads. Because the flaw requires no authentication, also check web server access logs for requests to the SWFUpload upload handler on affected sites.

CVE-2026-81294 is an unauthenticated privilege escalation flaw in the Authorizer WordPress plugin affecting all versions up to and including 3.15.1. Because the issue is reachable without authentication over the network (per the CVSS vector), an attacker can trigger it remotely with no credentials and no user interaction. A successful exploit allows the attacker to elevate their privileges on the affected WordPress site, gaining high-level access with confidentiality, integrity, and availability impact (CVSS 3.1: 9.8, critical). Any WordPress site running Authorizer version 3.15.1 or earlier is affected. As of now there is no known public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS puts 30-day exploitation probability at a modest 0.3%, so exploitation is not confirmed in the wild.

Do: Update the Authorizer plugin to the latest release available on WordPress.org (anything newer than 3.15.1) on every affected site, since the flaw is exploitable without authentication. Until patched, treat the plugin as exposed and check site logs for unexpected admin-user creation or privilege changes. If an immediate update is not possible, deactivate the plugin until a fixed version is deployed.

CVE-2026-81286 is a critical unauthenticated SQL injection (CWE-89) in the WCFM Marketplace multi-vendor plugin for WordPress, affecting versions 3.8.1 and earlier. An attacker with no account or privileges can trigger the flaw by sending a crafted HTTP request to an exposed plugin endpoint, where unsanitized input is executed as part of a database query. The CVSS score of 9.3 with a changed scope and high confidentiality impact indicates the attacker can read sensitive database contents beyond the plugin's own data, potentially including user credentials and marketplace records, with only limited availability impact. Any WordPress site running WCFM Marketplace 3.8.1 or older is affected, and multi-vendor WooCommerce marketplace sites are the primary deployments. There is no known public proof of concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no confirmed in-the-wild exploitation is documented yet.

Do: Update WCFM Marketplace to the latest available version above 3.8.1 as soon as possible; if immediate patching is not possible, temporarily deactivate the plugin or apply a WAF/virtual-patch rule for SQL injection. Review web-server and database logs for anomalous or unexpected queries, and audit user accounts for signs of credential exposure.

SigmaForms Pro – AI Generated Forms, a WordPress forms plugin, contains an arbitrary file deletion flaw (CWE-22) caused by insufficient file path validation in its delete_submission_files function. An unauthenticated attacker submits a path-traversal value through a form upload field; the value is stored in the database, and the targeted file is deleted when an administrator deletes that submission record from the WordPress admin panel. By deleting arbitrary files on the server, an attacker can cause data loss and achieve remote code execution when a critical file such as wp-config.php is removed. Every WordPress site running SigmaForms Pro in any version up to and including 1.4.11 is affected. The flaw is rated critical (CVSS 3.1: 9.8), has no known public proof-of-concept, is not listed in CISA's KEV, and EPSS estimates only a 0.7% chance of exploitation within the next 30 days.

Do: Update SigmaForms Pro to the first release after 1.4.11 as soon as a patched version is published, since all versions through 1.4.11 are affected and no fixed version is stated in the current data. Until patched, inspect stored form upload field values in the database for path-traversal strings (e.g., ../) and avoid deleting submission records until suspicious entries are removed, because deleting a submission is what triggers the file deletion. If compromise is suspected, verify the integrity of critical files such as wp-config.php.

CVE-2026-9055 is a critical (CVSS 9.8) unauthenticated privilege escalation flaw (CWE-269) in the Amelia (Premium) appointments and events booking plugin for WordPress, affecting versions 8.0 through 9.6.2. It stems from insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint: an attacker can get the plugin to treat them as a manager, and when the 'externalId' parameter is set to 0 a WordPress user with the 'wpamelia-manager' role is created. From the manager role, the attacker can then create a provider entity linked to an administrator's user ID and overwrite that administrator's password, gaining full administrator access to the site. Any WordPress site running Amelia Premium in the affected version range is exposed, with risk highest where the plugin's customer-update endpoint is reachable by anonymous visitors (its typical default deployment). No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS is low at 0.3%, so exploitation has not been confirmed.

Do: Upgrade Amelia Premium to the latest vendor release (anything newer than 9.6.2; the exact patched version is not specified in the available data). Until patched, restrict anonymous access to the Amelia customer-update endpoint and audit sites for unexpected WordPress accounts with the wpamelia-manager role, provider entities linked to administrator user IDs, and unexplained administrator password changes or new admin accounts.

The Nokri Job Board WordPress theme fails to properly validate password reset tokens in its nokri_reset_password() function, allowing an attacker-supplied empty token to match a user's empty or unset sb_password_forget_token meta value. Because reset tokens are only set after a user requests a password reset, most users have this field unset, so an unauthenticated attacker can trigger a password reset for any user, including administrators. By then logging in with the password they set, the attacker gains full control of the targeted account, and on an administrator account this typically leads to complete site takeover. All versions up to and including 1.6.6 are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts near-term exploitation probability at roughly 0.3%, so exploitation is not known to be occurring yet.

Do: Update the Nokri theme to the first release after version 1.6.6 as soon as a patched version is available. Until patched, watch administrator and user accounts for unexpected password resets or logins, and consider restricting the theme's password-reset endpoint via a firewall rule. If compromise is suspected, rotate all credentials and review recently changed accounts.

The WPLP Cookie Consent plugin for WordPress, in all versions up to and including 4.4.1, combines missing file type validation in its saas_upload_logo() function with an authorization bypass on the WPLP connector REST endpoints. Because those REST routes require no authentication, an unauthenticated attacker can send a crafted request that uploads an arbitrary file, such as a PHP file, to the affected site's server. Depending on where the file lands and how the server is configured, this can lead to remote code execution and full site compromise, consistent with the 9.8 CVSS score. Any WordPress site running WPLP Cookie Consent version 4.4.1 or earlier is exposed. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and its EPSS of 0.5% (42nd percentile) suggests a low probability of near-term exploitation.

Do: Update the WPLP Cookie Consent plugin as soon as a patched release beyond 4.4.1 becomes available. Until patched, deactivate the plugin or block unauthenticated access to its connector REST endpoints (e.g., via WAF or server rules restricting REST access), and review the uploads directory and web root for unexpected PHP files that could indicate prior exploitation.

CVE-2026-82226 is an unauthenticated PHP object injection flaw (deserialization of untrusted data, CWE-502) in the Tickera event ticketing plugin for WordPress, affecting versions up to and including 3.6.0.2. A remote attacker with no credentials and no user interaction can send crafted serialized PHP data to an affected request path, where it is unserialized without validation. Successful object injection can lead to high-impact consequences — potentially arbitrary code execution, file manipulation, or data disclosure depending on the gadget chains available on the target — which is reflected in the 9.8 (critical) CVSS score with C:H/I:H/A:H. Any WordPress site running Tickera 3.6.0.2 or older is affected. Exploitation has not been observed yet: EPSS estimates only a 0.3% probability of exploitation in the next 30 days, there is no public proof-of-concept, and the issue is not in CISA KEV.

Do: Update Tickera to the latest release, which must be newer than 3.6.0.2 (the fixed version is not specified in the available data). Until patched, consider a WAF rule or virtual patch that blocks unauthenticated requests carrying suspicious serialized payloads to the plugin's endpoints, and review web/application logs for anomalous serialized data since unauthenticated object injection flaws are directly reachable from the internet.

Hash Form, a WordPress form-builder plugin, versions up to and including 1.4.2 contain an unauthenticated arbitrary file upload flaw (CWE-434) that lets any unauthenticated remote visitor upload files of unrestricted type. An attacker triggers it by sending a crafted upload request to the plugin's upload functionality without logging in or interacting with an admin; because dangerous file types such as PHP are accepted, uploaded files can land in web-accessible upload directories. If the uploaded PHP file is executed by the web server, the attacker achieves remote code execution and full site compromise, consistent with the CVSS 10.0 critical score and changed scope. All WordPress sites running Hash Form 1.4.2 or earlier are affected. There is no confirmed in-the-wild exploitation yet, but a public proof-of-concept exists (EPSS 0.3%, not in CISA KEV), so patching is urgent despite currently low observed exploit probability.

Do: Update Hash Form to the latest release (any version above 1.4.2) immediately. If you cannot patch right away, block unauthenticated file-upload requests to the plugin's endpoints via a WAF rule and review WordPress upload directories for unexpected .php or other executable files, which would indicate prior compromise. Given the public PoC, assume opportunistic scanning may begin soon.

Newspapers X, a WordPress theme by Silk Themes, contains an improper validation of a specified quantity in input (CWE-1284) in versions 1.0.46 through 1.0.48, which allows an attacker to implant malicious software on affected sites. Because the flaw is rated with network attack vector, no privileges required, and no user interaction, it can be triggered remotely by an unauthenticated attacker sending a crafted request that supplies an unvalidated quantity to the vulnerable component. The CVSS 3.1 score of 10.0 with scope changed and high confidentiality, integrity, and availability impact indicates the attacker can gain deep control of the site, including implanting malware and potentially affecting resources beyond the vulnerable component. Sites running Newspapers X versions 1.0.46 through 1.0.48 are affected; per the advisory, versions outside this range, including those before 1.0.46, are not listed as vulnerable. No public proof-of-concept is known, exploitation probability is low (EPSS 0.3%), and the flaw is not in CISA KEV, so no exploitation is currently known.

Do: Update the Newspapers X theme to the latest available release beyond version 1.0.48 and confirm the running version in the WordPress admin (Appearance > Themes). If an immediate update is not possible, consider temporarily switching themes or deploying a WAF/virtual-patching rule that limits unvalidated quantity inputs, since the flaw is exploitable without authentication. Monitor theme vendor advisories for the fixed version number, as none is specified in the available data.

CVE-2026-81763 is an unauthenticated SQL injection (CWE-89) in the WordPress anti-spam plugin Throws SPAM Away, affecting all versions up to and including 3.8.2. Because the flaw requires no privileges and no user interaction, a remote attacker can trigger it directly with crafted input to an affected site's front end. The critical CVSS 3.1 score of 9.3 (high confidentiality impact, low availability impact, changed scope) indicates that sensitive database contents could be exposed, potentially beyond the plugin's own tables. Any WordPress site running Throws SPAM Away 3.8.2 or older is affected. No exploitation is currently known: EPSS is low at 0.2% over 30 days (~15th percentile), the issue is not in CISA KEV, and no public proof-of-concept or in-the-wild reports exist.

Do: Update Throws SPAM Away to the newest release (any version above 3.8.2); the fixed version number is not given in the source data, so check the WordPress.org plugin page for the current release. Until patched, consider temporarily deactivating the plugin or deploying WAF rules that block common SQL injection patterns in unauthenticated front-end requests. Review web access logs for unauthenticated requests containing SQL syntax (e.g., quotes, UNION/SELECT payloads) and, if suspicious activity is found, treat database contents such as credentials as potentially exposed.

Smart Marketing SMS and Newsletters Forms, a WordPress plugin for collecting newsletter and SMS subscribers, contains an unauthenticated SQL injection flaw (CWE-89) affecting all versions up to and including 5.1.24. Because the issue requires no authentication (CVSS PR:N) and is reachable over the network with low attack complexity, an unauthenticated attacker can likely trigger it by sending a crafted request to one of the plugin's publicly accessible endpoints, such as the front-end form handlers the plugin provides. Successful exploitation primarily allows the attacker to read data from the site's database (high confidentiality impact); the changed-scope designation suggests the exposed data may be used across the wider site, potentially including subscriber records collected by the plugin, with no integrity loss and at most limited availability impact in the base score. Any WordPress site running the plugin at version 5.1.24 or older is affected. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and its EPSS estimate (0.3%) is low.

Do: Sites running Smart Marketing SMS and Newsletters Forms should update to the first release newer than 5.1.24 as soon as a patched version is available. Until then, consider deactivating the plugin if it is not actively used, or apply WAF rules that block SQL injection patterns against the plugin's public endpoints, and review web logs for suspicious unauthenticated requests. After updating, check the WordPress database for signs of unexpected reads or modifications.