Vulnerability & Patch Roundup — September 2026
Sucuri's September 2026 roundup covers WordPress plugin patches including unauthenticated DoS in WooCommerce and arbitrary shortcode execution in WPForms.
Sucuri's monthly roundup lists a dozen-plus patched CVEs in widely deployed WordPress plugins. Highlights include unauthenticated Denial of Service in WooCommerce <11.1.0 (CVE-2026-48888, 7M+ installs), authenticated Shop Manager+ SQL injection (CVE-2026-57777), unauthenticated SSRF and reflected XSS in LiteSpeed Cache <=7.9 (CVE-2026-84761, CVE-2026-76579), and unauthenticated arbitrary shortcode execution in WPForms 1.5.0.1-2.0.2 (CVE-2026-84744, 5M+ installs). Rank Math SEO, All-in-One WP Migration, and UpdraftPlus also patched authorization and information-exposure flaws; Sucuri Firewall clients are already protected.
- WooCommerce <11.1.0 patches unauthenticated DoS (CVE-2026-48888) affecting 7M+ installations
- WPForms arbitrary shortcode execution fixed in 2.0.2.1; plugin installed on 5M+ sites
- LiteSpeed Cache <=7.9 patches unauthenticated SSRF and reflected XSS in 7.9.1
- Rank Math SEO, UpdraftPlus, All-in-One WP Migration also patched auth and info-exposure flaws
- CVEs
- CVE-2026-48888CVE-2026-84761CVE-2026-57777CVE-2026-76579CVE-2026-84744CVE-2026-88996CVE-2026-74991CVE-2026-89064CVE-2026-81810CVE-2026-77783CVE-2026-82841CVE-2026-77784
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48888 | Unauthenticated resource-exhaustion DoS in WooCommerce before 11.1.0 | 7.5 | <1% | ||
| CVE-2026-57777 | Blind SQL Injection in Automattic WooCommerce (WordPress) | 7.6 | <1% | ||
| CVE-2026-74991 | The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on… | 6.8 | — | ||
| CVE-2026-76579 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due… | 4.7 | — | ||
| CVE-2026-77783 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing… | 3.7 | <1% | ||
| CVE-2026-77784 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing… | 2.7 | <1% | ||
| CVE-2026-81810 | Broken access control in All-in-One WP Migration and Backup plugin allows admin takeover | 7.2 | — | ||
| CVE-2026-82841 | The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus | 5.3 | — | ||
| CVE-2026-84744 | The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the… | 6.5 | — | ||
| CVE-2026-84761 | Unauthenticated SSRF in LiteSpeed Cache WordPress plugin (≤ 7.9) | 7.2 | <1% | ||
| CVE-2026-88996 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site… | 6.1 | — | ||
| CVE-2026-89064 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110 | 5.3 | — |
From the original article
11 min read at blog.sucuri.net
If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed.
By Sucuri Malware Research Team · blog.sucuri.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.