Vulnerabilities

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

Do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.

Hash Form, a WordPress form-builder plugin, versions up to and including 1.4.2 contain an unauthenticated arbitrary file upload flaw (CWE-434) that lets any unauthenticated remote visitor upload files of unrestricted type. An attacker triggers it by sending a crafted upload request to the plugin's upload functionality without logging in or interacting with an admin; because dangerous file types such as PHP are accepted, uploaded files can land in web-accessible upload directories. If the uploaded PHP file is executed by the web server, the attacker achieves remote code execution and full site compromise, consistent with the CVSS 10.0 critical score and changed scope. All WordPress sites running Hash Form 1.4.2 or earlier are affected. There is no confirmed in-the-wild exploitation yet, but a public proof-of-concept exists (EPSS 0.3%, not in CISA KEV), so patching is urgent despite currently low observed exploit probability.

Do: Update Hash Form to the latest release (any version above 1.4.2) immediately. If you cannot patch right away, block unauthenticated file-upload requests to the plugin's endpoints via a WAF rule and review WordPress upload directories for unexpected .php or other executable files, which would indicate prior compromise. Given the public PoC, assume opportunistic scanning may begin soon.

CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.

Do: Immediately update GiveWP to the latest patched release (any version newer than 4.16.7.1); verify the installed version on the WordPress plugins admin page before and after updating. If updating is not yet possible, temporarily deactivate or restrict access to the plugin's public endpoints and review web and PHP logs for unexpected serialized payloads or newly created admin users and unknown files indicative of object-injection exploitation. Continue monitoring, as a public PoC is available and weaponization could raise the exploitation risk even though EPSS is currently low.

The All-in-One WP Migration and Backup plugin for WordPress (all versions up to and including 7.109) contains an SQL injection flaw (CWE-89) in its archive restore functionality, caused by insufficient escaping of user-supplied parameters and failure to properly prepare existing SQL queries. An unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the site database. Attackers can leverage this to obtain the ai1wm_secret_key when a site administrator performs an archive restore, which can then be escalated to remote code execution. Any WordPress site running the plugin at version 7.109 or earlier is affected. Two public proofs of concept exist on GitHub, but there is no confirmed in-the-wild exploitation yet (EPSS 0.5%, not in CISA KEV), so defenders should treat this as a likely near-term target given the plugin's install base.

Do: Update All-in-One WP Migration and Backup to the latest patched release (any version after 7.109) as soon as possible. Until patched, avoid performing archive restores, especially from untrusted archives, and verify the site's ai1wm_secret_key has not been exposed (rotate it if unsure), since its disclosure enables the RCE chain. Review logs for unexpected SQL errors or queries against the restore endpoint and check whether the plugin is active on internet-facing sites.

Easy Media Replace, a WordPress plugin for swapping media attachments, does not sanitise or escape the attachment title before outputting it inside an HTML attribute in the media library list view. Any user with Author privileges or higher can save an attachment title containing arbitrary web script, which then executes in the browser of an administrator or other higher-privileged user who opens the media library list view. A successful injection lets the attacker act within the victim's session, for example creating rogue admin accounts or altering site content. All WordPress sites running the plugin at version 0.2.0 or earlier are affected. Exploitation has not been reported in the wild; a public proof of concept exists, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

Do: WordPress administrators running Easy Media Replace 0.2.0 or earlier should update to the latest patched release as soon as one is available (no fixed version number is given in the current data). Until patching, deactivate the plugin or restrict media uploads and title editing to fully trusted users, and review existing attachment titles for injected script markup that would fire when an admin views the media list. Because a public proof of concept exists, treat any site with Author-role contributors on an unpatched version as exposed and check recent administrator activity for signs of session abuse.