🔐 WordPress Frontend Admin Flaw Enables Administrator Takeover
Sites running Frontend Admin should patch immediately, especially if frontend user forms are publicly exposed. The potential for direct administrator account takeover makes this a top-priority WordPress update.
CVE-2026-18432 is a privilege-escalation vulnerability in the DynamiApps Frontend Admin plugin for WordPress through version 3.29.9. A crafted non-numeric user ID can bypass an authorization check and ultimately target the administrator account, allowing password or email changes. The issue is CRITICAL with CVSS 9.8 and can be exploited without authentication when a public frontend user form is configured, or otherwise by a subscriber-level attacker.
🔗 Read more 🔗
Source: NVD
🌐 Royal Elementor Addons SSRF Exposes Internal Services
WordPress administrators using Royal Elementor Addons should patch promptly, particularly on sites with untrusted Contributor accounts. SSRF can expose cloud metadata or internal services that are otherwise unreachable from the internet.
CVE-2026-17123 is a server-side request forgery vulnerability in the Royal Elementor Addons WordPress plugin through version 1.7.1064. A Contributor-level attacker can persist an arbitrary webhook URL and cause the application to send requests to internal, loopback, or otherwise attacker-selected destinations without effective host filtering. The vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
🗑️ Podlove File Deletion Flaw Can Lead to Remote Code Execution
Podlove installations that allow Contributor-level users should be patched urgently. Arbitrary file deletion combined with an available gadget chain creates a credible path toward full server compromise.
CVE-2026-16099 affects the Podlove Podcast Publisher plugin for WordPress through version 4.5.3 and permits arbitrary server-side file deletion. Contributor-level attackers can exploit insufficient path validation, with deletion of sensitive files such as wp-config.php potentially leading to remote code execution; the plugin also contains a viable POP chain involving its GenerationGuard class. The vulnerability is HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
🚨 ProSolution WP Client Upload Bug Enables Unauthenticated RCE
Any site running ProSolution WP Client should patch immediately, with internet-facing job portal deployments treated as especially urgent. Unauthenticated arbitrary file upload with an RCE path presents a direct server-compromise risk.
CVE-2026-16098 is an arbitrary file-upload vulnerability in the ProSolution WP Client plugin for WordPress through version 2.0.10. An attacker can manipulate the Content-Disposition filename so that an executable file is written despite extension checks, and the required nonce is publicly exposed on pages using the job portal shortcode. The issue is CRITICAL with CVSS 9.8 and can enable unauthenticated remote code execution.
🔗 Read more 🔗
Source: NVD
💉 Autopay WordPress Plugin Allows Unauthenticated Stored XSS
WooCommerce operators using the affected Autopay plugin should patch quickly because exploitation requires no authenticated account. Checkout-page script execution can put customer sessions and sensitive browser-side data at risk.
CVE-2026-15002 is a stored cross-site scripting vulnerability in the Platnosci Online Blue Media Autopay plugin for WordPress through version 5.0.0. Missing capability checks, nonce verification, input sanitization, and output escaping allow unauthenticated attackers to persist malicious content that executes on the WooCommerce checkout page. The vulnerability is rated HIGH with CVSS 7.2.
🔗 Read more 🔗
Source: NVD
📁 ProSolution WP Client File Deletion Can Escalate to RCE
Affected ProSolution WP Client deployments should be patched immediately. Because the attack is unauthenticated and can progress from arbitrary deletion to server compromise, internet-facing installations deserve emergency priority.
CVE-2026-14524 is an arbitrary file-deletion vulnerability in the ProSolution WP Client plugin for WordPress through version 2.0.8. An unauthenticated attacker can poison session state with a path-traversal value and then delete an arbitrary server file using only the publicly exposed frontend nonce. The issue is CRITICAL with CVSS 9.1 and deletion of files such as wp-config.php can lead to remote code execution.
🔗 Read more 🔗
Source: NVD
⚙️ Query Wrangler Lets Subscribers Execute Server-Side Code
Sites using Query Wrangler should patch urgently if they permit subscriber or other low-privilege accounts. Low-privilege authenticated RCE can turn a minor account compromise into complete WordPress and server takeover.
CVE-2026-14498 is a remote code execution vulnerability in the Query Wrangler plugin for WordPress through version 1.5.57. Missing capability and nonce checks allow a subscriber-level attacker to replace saved query options with attacker-controlled values that reach dynamic function execution. The vulnerability is HIGH with CVSS 8.8 and requires only that at least one query row exists.
🔗 Read more 🔗
Source: NVD
🧨 Evergreen OpenSRF Gateway Hit by Public SQL Injection Exploit
Evergreen operators should upgrade to the listed fixed versions as a high priority. Public exploit availability materially raises the risk for any exposed OpenSRF gateway.
CVE-2026-19926 is a remotely exploitable SQL injection vulnerability in Evergreen affecting versions through 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The flaw resides in the /osrf-gateway-v1 path of the open-ils.fielder OpenSRF service, and a public exploit has been disclosed and may be used. The issue is HIGH with CVSS 7.3, with fixed releases available as 3.14.12, 3.15.12, 3.16.6, and 3.17-beta2.
🔗 Read more 🔗
Source: NVD
📡 Tenda AC10 Authentication Flaw Has Public Exploit Details
Owners and administrators of affected Tenda AC10 routers should prioritize remediation and restrict management exposure in the meantime. The combination of remote reachability, CRITICAL severity, and public exploit disclosure makes rapid action important.
CVE-2026-19924 is an improper-authentication vulnerability affecting the Tenda AC10 firmware version 16.03.10.09_multi_TDE01. The flaw affects the R7WebsSecurityHandler function in the device’s httpd component and can be attacked remotely. It is CRITICAL with CVSS 9.8, and an exploit has been publicly disclosed and may be used.
🔗 Read more 🔗
Source: NVD
🛒 Online Shopping System Login Exposed to Public SQL Injection
Any exposed deployment of Online Shopping System 1.0 should be remediated quickly or removed from public access until fixed. Public exploit availability increases the likelihood of opportunistic attacks against vulnerable login endpoints.
CVE-2026-19919 is a SQL injection vulnerability in code-projects Online Shopping System 1.0. Attackers can remotely manipulate the email argument handled by /login.php to trigger SQL injection. The issue is HIGH with CVSS 7.3, and exploit details have been made public and could be used.
🔗 Read more 🔗
Source: NVD
💣 Pandora DAA Decompression Bug Enables Memory-Exhaustion DoS
Pandora deployments that process untrusted file submissions should apply the patched version promptly. Systems exposed to arbitrary archive uploads are the highest priority because a small malicious DAA file can consume substantial resources.
CVE-2026-74767 is a denial-of-service vulnerability in Pandora’s handling of DAA archive files. Crafted highly compressed data can expand dramatically during extraction because decompression was performed without an output-size limit, potentially exhausting memory or CPU and disrupting the extraction worker or service. The vulnerability is HIGH with CVSS 8.7, and the patch adds bounded decompression plus cumulative size checks.
🔗 Read more 🔗
Source: NVD
📦 Pandora TAR Traversal Flaw Can Overwrite Files and Enable RCE
Pandora operators accepting untrusted TAR uploads should patch immediately. A CVSS 10.0 archive traversal issue with possible arbitrary code execution warrants emergency treatment on exposed file-processing services.
CVE-2026-74764 is a path traversal vulnerability in Pandora’s TAR archive extraction functionality. Malicious archive paths using traversal sequences or absolute paths can cause files to be written outside the intended extraction directory, potentially enabling file overwrite, application compromise, remote code execution, or denial of service. The vulnerability is CRITICAL with CVSS 10.0, and the fix applies Python’s safe data extraction filter.
🔗 Read more 🔗
Source: NVD