Vulnerabilities

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

Do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.