Security Digest: May 15, 2026 - 5 Critical Vulnerabilities

Today’s threat picture is dominated by two urgent themes: a trojanized software supply-chain package that could already be sitting on Windows endpoints, and multiple high-risk auth and privilege flaws that can let attackers take over WordPress sites, bypass MLflow authentication, or trigger unwanted actions in exposed systems.

· 8 min read

Executive Summary

Today’s threat picture is dominated by two urgent themes: a trojanized software supply-chain package that could already be sitting on Windows endpoints, and multiple high-risk auth and privilege flaws that can let attackers take over WordPress sites, bypass MLflow authentication, or trigger unwanted actions in exposed systems. Act now: remove suspicious DAEMON Tools Lite installers, patch affected platforms immediately, and review any WordPress or MLflow deployments for exposure.

Security teams should treat these issues as same-day response items. Prioritize endpoint checks for the compromised Windows installer, then move to web application patching and access-control verification before the next login window or public-facing scan catches you.

Critical Vulnerabilities

CVE-2026-8398: DAEMON Tools Lite installer supply-chain compromise

  • Impact: Attackers can distribute trojanized, digitally signed installers that appear legitimate, potentially enabling malware execution and bypassing signature-based trust checks.
  • Affected Systems: Windows DAEMON Tools Lite 12.5.0.2421 through 12.5.0.2434, downloaded from the official site daemon-tools.cc between approximately April 8, 2026 and May 5, 2026.
  • Immediate Action: Assume exposure if you installed or distributed these builds. Quarantine affected endpoints, remove the installer, and hunt for the trojanized binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe.
  • Mitigation: Reinstall only from a verified clean package from the vendor after confirming remediation guidance. Rotate credentials and review endpoints for suspicious persistence, outbound connections, and unauthorized code execution.

CVE-2026-6228: Frontend Admin privilege escalation

  • Impact: Attackers can escalate from low-privilege access to administrator by abusing form role handling in WordPress.
  • Affected Systems: Frontend Admin by DynamiApps plugin for WordPress, versions up to and including 3.28.36.
  • Immediate Action: Update or disable the plugin now. Review recent user registrations, editor accounts, and any suspicious form changes or new admin users.
  • Mitigation: Patch to a fixed release as soon as available. Until then, restrict editor access, remove public registration if not required, and audit form configurations for unauthorized role options.

CVE-2026-2652: MLflow authentication bypass

  • Impact: Unauthenticated attackers can submit jobs, read results, cancel jobs, and inject trace data into experiments.
  • Affected Systems: mlflow/mlflow 3.9.0 and earlier when started with --app-name basic-auth and served via uvicorn (ASGI).
  • Immediate Action: Upgrade to MLflow 3.10.0 immediately. If you cannot patch right away, restrict network access to the service and block public exposure.
  • Mitigation: Apply the fixed version and verify that non-/gateway/ routes are not reachable without authentication. Monitor for unexpected job submissions and trace ingestion activity.

CVE-2026-28761: Musetheque V4 CSRF

  • Impact: A logged-in user can be tricked into performing unexpected actions by visiting a malicious page.
  • Affected Systems: Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier.
  • Immediate Action: Limit access to trusted users only until a fix is applied. Warn users not to browse untrusted pages while signed in.
  • Mitigation: Apply vendor patches when available. If no patch exists, reduce exposure, enforce short sessions, and review whether the product should be isolated from general user browsing.

CVE-2026-4094: FOX Currency Switcher data-loss flaw

  • Impact: Authenticated users can delete the entire multi-currency configuration; the issue is also CSRF-exploitable against administrators.
  • Affected Systems: FOX – Currency Switcher Professional for WooCommerce versions up to and including 1.4.5.
  • Immediate Action: Patch immediately and check whether any site already lost currency settings. Disable unnecessary wp-admin access for lower-privilege users.
  • Mitigation: Update to a fixed version. Until then, restrict wp-admin access, log out inactive sessions, and verify that no requests are carrying the woocs_reset parameter.

Previously Alerted

What to Do Now

  1. Patch or remove exposed software today: MLflow, Frontend Admin, and FOX Currency Switcher should be updated or disabled immediately; isolate DAEMON Tools Lite installs tied to the affected build window.
  2. Check for signs of compromise: Search for the trojanized DAEMON Tools binaries, unexpected WordPress administrator accounts, unusual MLflow job activity, and currency-setting resets.
  3. Reduce exposure: Restrict public registration, lock down wp-admin, and limit access to MLflow and Musetheque to trusted networks only.
  4. Verify remediation: Confirm installed versions, review plugin inventories, and validate that patched services require authentication on all routes.
  5. Escalate suspicious activity: Treat any unexplained admin creation, job submission, or endpoint persistence as a potential incident.

Verification Steps

  • Confirm DAEMON Tools Lite versions against 12.5.0.2421–12.5.0.2434 and remove any installer from the affected date range.
  • Inventory WordPress plugins and check for Frontend Admin 3.28.36 or earlier and FOX Currency Switcher 1.4.5 or earlier.
  • Validate MLflow is on 3.10.0 or later and test unauthenticated access to non-/gateway/ routes.
  • Review logs for suspicious form submissions, new admin users, and requests containing woocs_reset.

Monitoring Recommendations

  • Alert on new WordPress administrator creation, role changes, and plugin setting resets.
  • Watch for unusual outbound connections and persistence artifacts on endpoints that ran the compromised installer.
  • Track MLflow job creation, cancellation, and trace ingestion from unknown sources.
  • Increase scrutiny on CSRF-prone admin actions and public-facing forms.

Related Resources

  • Internal blog posts: Upcoming analysis on supply-chain compromise detection, WordPress privilege-escalation containment, and MLflow exposure hardening.
  • Official vendor advisories: Check vendor security pages for DAEMON Tools / AVB Disc Soft, DynamiApps, MLflow, Musetheque / IPKNOWLEDGE, and FOX / WooCommerce plugin guidance.

Keep reading