Security Digest: May 20, 2026 - 14 Critical Vulnerabilities

Today’s disclosures include several critical WordPress plugin flaws that can lead to full site takeover, plus high-severity issues in NVIDIA Triton, memcached, 389-ds-base, and E-LAN recording systems. The most urgent risks are unauthenticated privilege escalation, arbitrary file upload, SQL injection, and authentication bypass.

· 11 min read

May 20, 2026: Multiple Critical Flaws Demand Immediate Action

Executive Summary: Today’s disclosures include several critical WordPress plugin flaws that can lead to full site takeover, plus high-severity issues in NVIDIA Triton, memcached, 389-ds-base, and E-LAN recording systems. The most urgent risks are unauthenticated privilege escalation, arbitrary file upload, SQL injection, and authentication bypass. Patch exposed systems now, disable vulnerable plugins where needed, and treat internet-facing WordPress and AI inference deployments as top priority.

Critical Vulnerabilities

CVE-2026-7284: Easy Elements for Elementor privilege escalation

  • Impact: Unauthenticated attackers can register as administrator and take over the site.
  • Affected Systems: Easy Elements for Elementor – Addons & Website Templates up to 1.4.4.
  • Immediate Action: Disable or remove the plugin immediately if it is exposed on a public site.
  • Mitigation: Apply the vendor fix as soon as available; review all recent admin accounts and reset credentials.

CVE-2026-6555: ProSolution WP Client arbitrary file upload

  • Impact: Attackers can upload malicious PHP and achieve remote code execution.
  • Affected Systems: ProSolution WP Client up to 2.0.0.
  • Immediate Action: Take the plugin offline or block file-upload endpoints until patched.
  • Mitigation: Update to a fixed release; inspect the web-accessible upload directory for unexpected files.

CVE-2026-24207: NVIDIA Triton authentication bypass

  • Impact: Attackers may bypass authentication and potentially gain code execution, privilege escalation, tampering, DoS, or data exposure.
  • Affected Systems: NVIDIA Triton Inference Server deployments affected by the advisory.
  • Immediate Action: Restrict network access to Triton immediately; do not expose it publicly.
  • Mitigation: Apply NVIDIA’s security update and verify auth controls at every ingress point.

CVE-2026-7637: Boost PHP object injection

  • Impact: Unauthenticated attackers can inject objects; impact depends on whether another plugin/theme provides a POP chain.
  • Affected Systems: Boost plugin up to 2.0.3.
  • Immediate Action: Update or disable the plugin; assume exposure if the site uses multiple plugins.
  • Mitigation: Patch promptly and audit for suspicious cookie activity involving STYXKEY-BOOST_USER_LOCATION.

CVE-2026-7467: Read More & Accordion privilege escalation

  • Impact: Authenticated attackers can create or modify admin accounts.
  • Affected Systems: Read More & Accordion up to 3.5.7.
  • Immediate Action: Remove elevated plugin access and update immediately.
  • Mitigation: Restrict import permissions, patch the plugin, and review users and wp_usermeta for unauthorized changes.

CVE-2026-5200: AcyMailing missing authorization

  • Impact: Subscriber-level users may alter privileged settings, export secret keys, and chain to admin takeover.
  • Affected Systems: AcyMailing up to 10.8.2.
  • Immediate Action: Patch now and review subscriber permissions.
  • Mitigation: Remove unnecessary low-privilege accounts and rotate secrets if abuse is suspected.

CVE-2026-6456: Account Switcher privilege escalation

  • Impact: Subscriber-level attackers can switch into other accounts, including administrator.
  • Affected Systems: Account Switcher up to 1.0.2.
  • Immediate Action: Disable the plugin or block REST access until fixed.
  • Mitigation: Apply the vendor patch, then review all recent session and login activity.

CVE-2026-47783: memcached SASL username timing leak

  • Impact: Attackers may infer valid usernames through timing analysis.
  • Affected Systems: memcached before 1.6.42.
  • Immediate Action: Upgrade memcached and limit SASL exposure to trusted networks.
  • Mitigation: Restrict access, rotate credentials if needed, and monitor for repeated auth probing.

CVE-2026-47784: memcached SASL password timing leak

  • Impact: Attackers may infer password data via timing side channels.
  • Affected Systems: memcached before 1.6.42.
  • Immediate Action: Patch immediately and treat SASL auth as exposed until upgraded.
  • Mitigation: Place memcached behind strict network controls and review authentication logs.

CVE-2026-9064: 389-ds-base LDAP denial of service

  • Impact: A remote attacker can exhaust CPU and memory, causing service degradation or outage.
  • Affected Systems: 389-ds-base LDAP server deployments affected by the advisory.
  • Immediate Action: Patch and rate-limit LDAP traffic from untrusted sources.
  • Mitigation: Reduce exposure, monitor worker starvation and memory spikes, and block malformed control-heavy requests.

CVE-2026-9003: E-LAN Hybrid Recording System SQL injection

  • Impact: Unauthenticated attackers can read database contents through SQL injection.
  • Affected Systems: TONNET E-LAN Hybrid Recording System deployments.
  • Immediate Action: Isolate the system from the internet and apply vendor guidance.
  • Mitigation: Patch, review database access logs, and assume sensitive data exposure if the system was public.

CVE-2026-9010: Boost time-based SQL injection

  • Impact: Attackers can extract sensitive database information.
  • Affected Systems: Boost plugin up to 2.0.3.
  • Immediate Action: Update immediately; consider disabling public-facing forms that pass current_url or user_name.
  • Mitigation: Patch, then review application and database logs for suspicious query timing patterns.

CVE-2026-3985: Creative Mail SQL injection

  • Impact: Unauthenticated attackers can query and potentially extract sensitive database data.
  • Affected Systems: Creative Mail up to 1.6.9.
  • Immediate Action: Patch now and restrict access to checkout-related endpoints.
  • Mitigation: Verify the fix, then hunt for abnormal requests using checkout_uuid.

CVE-2026-24206: NVIDIA Triton authentication bypass

  • Impact: Attackers may bypass authentication and potentially gain privilege escalation, denial of service, or information disclosure.
  • Affected Systems: NVIDIA Triton Inference Server deployments affected by the advisory.
  • Immediate Action: Restrict access and patch immediately.
  • Mitigation: Apply the vendor update and verify that authentication is enforced end-to-end.

What to Do Now

  1. Prioritize internet-facing WordPress sites, Triton servers, and LDAP/memcached services. Patch or disable vulnerable components first.
  2. Remove or isolate vulnerable plugins if you cannot patch immediately, especially those enabling admin takeover or file upload.
  3. Review accounts, sessions, and recent admin creation events. Assume compromise if any affected WordPress site was public.
  4. Check upload directories, web roots, and plugin logs for unexpected PHP files, new users, or suspicious parameter abuse.
  5. Restrict exposure at the network layer for Triton, memcached, LDAP, and E-LAN systems until updates are confirmed.

Verification steps: Confirm installed versions against the affected ranges, validate that patches are active, and scan for unauthorized admin users, altered plugin settings, and unusual database activity.

Monitoring recommendations: Watch for spikes in login attempts, REST API abuse, file uploads, SQL error patterns, LDAP control floods, and any new outbound connections from WordPress hosts or inference servers.

Related Resources

  • Internal blog post: “Today’s Critical Web App and Infrastructure Vulnerabilities” — to be published.
  • Official vendor advisories: WordPress plugin changelogs, NVIDIA security bulletin, memcached release notes, 389-ds-base advisory, and TONNET product notice.

Keep reading