Vulnerabilities

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to a critical unauthenticated privilege escalation flaw (CVSS 3.1: 9.8) in all versions up to and including 3.6.2. The plugin fails to verify that a submitted form ID actually corresponds to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. By submitting crafted form data that references an arbitrary post, an unauthenticated attacker can cause the callback to run and create a new administrator-level user account, effectively taking full control of the site. Any WordPress site running the plugin at version 3.6.2 or earlier is affected. No public PoC or known in-the-wild exploitation exists, and the issue is not in CISA's KEV catalog, but the unauthenticated, high-impact nature means defenders should treat it as urgently patchable.

Do: Upgrade JetFormBuilder to a version newer than 3.6.2 (the latest available release) immediately; if no update is available yet, deactivate the plugin or use a firewall/WAF rule to restrict its form-submission endpoint. After patching, review the WordPress user list for any unexpected administrator accounts created recently and check access logs for anomalous form submissions from unauthenticated sources. If a rogue admin is found, remove the account, rotate all credentials and salts, and audit for malicious plugins, uploads, or modified theme files.

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

Do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.

Hash Form, a WordPress form-builder plugin, versions up to and including 1.4.2 contain an unauthenticated arbitrary file upload flaw (CWE-434) that lets any unauthenticated remote visitor upload files of unrestricted type. An attacker triggers it by sending a crafted upload request to the plugin's upload functionality without logging in or interacting with an admin; because dangerous file types such as PHP are accepted, uploaded files can land in web-accessible upload directories. If the uploaded PHP file is executed by the web server, the attacker achieves remote code execution and full site compromise, consistent with the CVSS 10.0 critical score and changed scope. All WordPress sites running Hash Form 1.4.2 or earlier are affected. There is no confirmed in-the-wild exploitation yet, but a public proof-of-concept exists (EPSS 0.3%, not in CISA KEV), so patching is urgent despite currently low observed exploit probability.

Do: Update Hash Form to the latest release (any version above 1.4.2) immediately. If you cannot patch right away, block unauthenticated file-upload requests to the plugin's endpoints via a WAF rule and review WordPress upload directories for unexpected .php or other executable files, which would indicate prior compromise. Given the public PoC, assume opportunistic scanning may begin soon.

CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.

Do: Immediately update GiveWP to the latest patched release (any version newer than 4.16.7.1); verify the installed version on the WordPress plugins admin page before and after updating. If updating is not yet possible, temporarily deactivate or restrict access to the plugin's public endpoints and review web and PHP logs for unexpected serialized payloads or newly created admin users and unknown files indicative of object-injection exploitation. Continue monitoring, as a public PoC is available and weaponization could raise the exploitation risk even though EPSS is currently low.

The All-in-One WP Migration and Backup plugin for WordPress (all versions up to and including 7.109) contains an SQL injection flaw (CWE-89) in its archive restore functionality, caused by insufficient escaping of user-supplied parameters and failure to properly prepare existing SQL queries. An unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the site database. Attackers can leverage this to obtain the ai1wm_secret_key when a site administrator performs an archive restore, which can then be escalated to remote code execution. Any WordPress site running the plugin at version 7.109 or earlier is affected. Two public proofs of concept exist on GitHub, but there is no confirmed in-the-wild exploitation yet (EPSS 0.5%, not in CISA KEV), so defenders should treat this as a likely near-term target given the plugin's install base.

Do: Update All-in-One WP Migration and Backup to the latest patched release (any version after 7.109) as soon as possible. Until patched, avoid performing archive restores, especially from untrusted archives, and verify the site's ai1wm_secret_key has not been exposed (rotate it if unsure), since its disclosure enables the RCE chain. Review logs for unexpected SQL errors or queries against the restore endpoint and check whether the plugin is active on internet-facing sites.

Easy Media Replace, a WordPress plugin for swapping media attachments, does not sanitise or escape the attachment title before outputting it inside an HTML attribute in the media library list view. Any user with Author privileges or higher can save an attachment title containing arbitrary web script, which then executes in the browser of an administrator or other higher-privileged user who opens the media library list view. A successful injection lets the attacker act within the victim's session, for example creating rogue admin accounts or altering site content. All WordPress sites running the plugin at version 0.2.0 or earlier are affected. Exploitation has not been reported in the wild; a public proof of concept exists, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

Do: WordPress administrators running Easy Media Replace 0.2.0 or earlier should update to the latest patched release as soon as one is available (no fixed version number is given in the current data). Until patching, deactivate the plugin or restrict media uploads and title editing to fully trusted users, and review existing attachment titles for injected script markup that would fire when an admin views the media list. Because a public proof of concept exists, treat any site with Author-role contributors on an unpatched version as exposed and check recent administrator activity for signs of session abuse.

CVE-2026-19794 is a stored cross-site scripting (XSS) flaw in the WP-Stats plugin for WordPress, present in all versions up to and including 2.56, caused by insufficient input sanitization and output escaping. Because the injection requires no authentication, an unauthenticated attacker can submit malicious web scripts that the plugin stores and renders on pages of the affected site. Whenever a user opens a page containing the injected payload, the attacker's script executes in that user's browser, potentially allowing session hijacking, administrative actions performed as the victim, or injection of malicious content (the CVSS scope-changed rating reflects the risk of compromising other users, including site admins). Any WordPress site running WP-Stats version 2.56 or earlier is affected. Exploitation has not been confirmed in the wild, in CISA's KEV catalog, or per EPSS (0.2% 30-day probability), but one public proof-of-concept is available on GitHub.

Do: Update WP-Stats to a patched release newer than 2.56 as soon as the vendor publishes a fix; if no fixed version is available yet, deactivate the plugin until one ships. Audit pages rendered by the plugin (and related stored content such as comments or form fields) for unexpected scripts or injected HTML, and remove any payloads already stored on the site. Review web logs for unauthenticated requests targeting the plugin to check for signs of attempted exploitation.

CVE-2026-19089 is an unauthenticated arbitrary file upload flaw (CWE-434) in the Product Input Fields for WooCommerce WordPress plugin. When the plugin's accepted file-types setting is left empty — a state its own documentation describes as accepting all file types — the plugin performs no validation of uploaded file types, so anyone can submit files of any kind, including executable scripts, through the product input fields without an account. On servers where the upload directory's access rules are not honoured (i.e., uploaded files can be executed rather than just served), an attacker achieves remote code execution on the web server. All sites running the plugin in versions before 2.0.2 are affected, with critical severity (CVSS 9.8) because no authentication or user interaction is required. A public proof-of-concept is available, but current signals (EPSS ~0.5%, not in CISA KEV) indicate no confirmed in-the-wild exploitation yet.

Do: Update Product Input Fields for WooCommerce to version 2.0.2 or later. As interim mitigation, configure the accepted-types setting to explicitly allow only safe file types (e.g., images) and/or disable PHP execution in the upload directory at the web-server level. Administrators should also check the uploads directory for unexpected PHP files and review logs for unauthenticated upload activity.

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.

WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label.

Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use.

Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.