Security Digest: May 19, 2026 - 8 Critical Vulnerabilities

Today’s disclosures include a critical WordPress file-upload flaw that can lead to server compromise, a critical MLflow Assistant origin-validation issue that can be abused from a malicious webpage, and several high-severity memory corruption bugs in Samsung Escargot with remote-code-execution potential. There are also high-risk deserialization and privilege-escalation issues in AutoGPT, Mullvad VPN, and O+ Connect.

· 9 min read

Security Digest: May 19, 2026

Urgent alert: Eight serious vulnerabilities were disclosed today, including two critical remote-code-execution paths and multiple local privilege-escalation issues. If you run WordPress plugins, MLflow Assistant, AutoGPT, Mullvad VPN on macOS, or Samsung Escargot-based software, treat this as a patch-now event.

Executive Summary

Today’s disclosures include a critical WordPress file-upload flaw that can lead to server compromise, a critical MLflow Assistant origin-validation issue that can be abused from a malicious webpage, and several high-severity memory corruption bugs in Samsung Escargot with remote-code-execution potential. There are also high-risk deserialization and privilege-escalation issues in AutoGPT, Mullvad VPN, and O+ Connect.

Immediate priority: patch exposed systems first, disable or restrict affected features where possible, and verify no untrusted users can reach admin, installer, cache, or local pipe interfaces.

Critical Vulnerabilities

CVE-2026-4885: Piotnet Addons for Elementor Pro arbitrary file upload

  • Impact: Unauthenticated attackers may upload dangerous files and potentially achieve remote code execution on the WordPress server.
  • Affected Systems: Piotnet Addons for Elementor Pro for WordPress up to and including 7.1.70; exploit requires a form with a file field.
  • Immediate Action: Remove or disable the plugin now if you do not need it. If it must remain, disable any forms with file upload fields until patched.
  • Mitigation: Update to a fixed release as soon as available. Review uploads directories, webshell indicators, and recent plugin-generated files.

CVE-2026-2611: MLflow Assistant origin validation bypass

  • Impact: A malicious webpage can interact with a victim’s local MLflow Assistant, alter configuration, and enable arbitrary command execution through the Claude Code sub-agent.
  • Affected Systems: MLflow 3.9.0 with MLflow Assistant.
  • Immediate Action: Upgrade immediately to 3.10.0. Until then, do not run MLflow Assistant on endpoints used for general web browsing.
  • Mitigation: Isolate affected workstations, restrict local network exposure, and block untrusted browser access to localhost services where possible.

CVE-2026-47314: Samsung Escargot out-of-bounds write

  • Impact: Memory corruption may allow remote code execution or crash affected applications.
  • Affected Systems: Samsung Open Source Escargot at commit 590345cc6258317c5da850d846ce6baaf2afc2d3.
  • Immediate Action: Identify products embedding this Escargot build and apply the vendor update or remove exposure from untrusted input.
  • Mitigation: Backport the upstream fix, rebuild, and test any JavaScript engine integrations.

CVE-2026-47310: Samsung Escargot use-after-free

  • Impact: Attackers may manipulate pointers for remote code execution or denial of service.
  • Affected Systems: Samsung Open Source Escargot at commit 590345cc6258317c5da850d846ce6baaf2afc2d3.
  • Immediate Action: Patch any product shipping this engine and limit exposure to attacker-controlled content.
  • Mitigation: Update to a fixed Escargot revision and validate that downstream packages are rebuilt.

CVE-2026-47311: Samsung Escargot heap buffer overflow

  • Impact: Crafted input may trigger remote code execution or memory corruption.
  • Affected Systems: Samsung Open Source Escargot at commit 590345cc6258317c5da850d846ce6baaf2afc2d3.
  • Immediate Action: Prioritize patching any browser-like, embedded, or scripting-enabled product using Escargot.
  • Mitigation: Apply the vendor fix and add defense-in-depth controls such as sandboxing and input filtering.

CVE-2026-33233: AutoGPT Redis pickle deserialization

  • Impact: If an attacker can poison a shared Redis cache key, they may achieve arbitrary command execution in the backend container.
  • Affected Systems: AutoGPT 0.6.34 through 0.6.51.
  • Immediate Action: Upgrade to 0.6.52 immediately and treat Redis cache integrity as compromised until verified.
  • Mitigation: Restrict Redis access, rotate credentials, clear untrusted cache entries, and confirm no external systems can write to the cache.

CVE-2026-32323: Mullvad VPN macOS installer privilege escalation

  • Impact: A local admin-group user may be able to get root code execution during install or upgrade.
  • Affected Systems: Mullvad VPN on macOS 2026.1 and below.
  • Immediate Action: Upgrade to 2026.2-beta1 on macOS endpoints that install or upgrade the app.
  • Mitigation: Ensure /Applications/Mullvad VPN.app cannot be pre-positioned by untrusted users and review endpoint hardening policies.

CVE-2026-22069: O+ Connect local privilege escalation

  • Impact: A local attacker may gain higher privileges through the pipe interface.
  • Affected Systems: O+ Connect installations using the vulnerable pipe interface.
  • Immediate Action: Restrict local access to affected hosts and deploy the vendor patch as soon as it is available.
  • Mitigation: Until patched, remove unnecessary local users, monitor pipe access, and disable the service if it is not required.

What to Do Now

  1. Patch first: Update MLflow to 3.10.0, AutoGPT to 0.6.52, Mullvad VPN to 2026.2-beta1, and any vendor-fixed Escargot/O+ Connect releases.
  2. Reduce exposure: Disable vulnerable WordPress file-upload forms, remove unneeded plugins, and isolate systems that expose local assistants, cache services, or installer paths.
  3. Assume compromise where exposure existed: Review WordPress uploads, Redis cache activity, installer logs, and local pipe access for suspicious behavior.
  4. Hunt for abuse: Look for new webshells, unexpected child processes, unusual localhost-to-browser activity, and privilege changes on macOS and Windows endpoints.

Verification steps: Confirm installed versions match patched releases, inventory systems embedding Escargot, and check whether Redis is reachable only from trusted hosts. For WordPress, verify no file-upload forms remain enabled on vulnerable plugin versions.

Monitoring recommendations: Increase alerting on file creation in web roots, suspicious command execution from app containers, local privilege-escalation indicators, and any outbound connections from MLflow Assistant or related localhost services.

Related Resources

  • Internal: See the upcoming internal blog post on patch prioritization for internet-facing apps and developer tools.
  • Internal: See the upcoming internal blog post on detecting abuse of local services, installers, and cache deserialization.
  • Official vendor advisories: WordPress plugin advisory for Piotnet Addons for Elementor Pro; MLflow 3.10.0 release notes; Samsung Escargot security notices; AutoGPT 0.6.52 release notes; Mullvad VPN security update; O+ Connect advisory.

Keep reading