Security Digest: May 22, 2026 - 6 Critical Vulnerabilities

Six high-risk vulnerabilities disclosed today demand immediate action, led by three CVSS 10.0 flaws in UniFi OS devices that could allow unauthorized changes, file access, and remote command execution from the network. Two WordPress plugin flaws also raise urgent concern: one allows unauthenticated administrator takeover, and another enables SQL injection against vulnerable sites.

· 7 min read

Urgent Security Alert: UniFi OS, WordPress Plugins Expose Critical Attack Paths

Executive Summary

Six high-risk vulnerabilities disclosed today demand immediate action, led by three CVSS 10.0 flaws in UniFi OS devices that could allow unauthorized changes, file access, and remote command execution from the network. Two WordPress plugin flaws also raise urgent concern: one allows unauthenticated administrator takeover, and another enables SQL injection against vulnerable sites.

Act now: patch exposed systems first, disable unnecessary public access, and verify whether any UniFi OS consoles or affected WordPress plugins are installed and reachable.

Critical Vulnerabilities

CVE-2026-34908: UniFi OS Improper Access Control

  • Impact: A network-accessible attacker could make unauthorized changes to the system.
  • Affected Systems: UniFi OS devices exposed to the network.
  • Immediate Action: Restrict network access to management interfaces immediately and apply the vendor fix as soon as available.
  • Mitigation: Place UniFi management behind VPN or trusted admin networks only; review device admin accounts and recent configuration changes.

CVE-2026-34909: UniFi OS Path Traversal to Underlying Files

  • Impact: Attackers could access files on the underlying system and potentially reach an account usable for further compromise.
  • Affected Systems: UniFi OS devices exposed to the network.
  • Immediate Action: Treat any exposed UniFi OS instance as at risk and isolate it from untrusted networks now.
  • Mitigation: Patch immediately; limit file/system access paths at the perimeter and monitor for suspicious file reads or authentication anomalies.

CVE-2026-34910: UniFi OS Command Injection via Improper Input Validation

  • Impact: A remote attacker could execute commands on the device.
  • Affected Systems: UniFi OS devices exposed to the network.
  • Immediate Action: Prioritize emergency patching and remove any direct internet exposure to UniFi OS management services.
  • Mitigation: Apply the vendor update, enforce network segmentation, and inspect logs for unexpected process execution or configuration drift.

CVE-2026-33000: UniFi OS Command Injection Requiring High Privileges

  • Impact: A privileged network attacker could run arbitrary commands.
  • Affected Systems: UniFi OS devices where high-privilege access is possible.
  • Immediate Action: Review all privileged accounts and reduce administrative access to the minimum required.
  • Mitigation: Patch promptly, rotate admin credentials, and confirm that only trusted operators can reach management interfaces.

CVE-2026-9018: Easy Elements for Elementor Privilege Escalation

  • Impact: Unauthenticated attackers can create a new account with administrator-level privileges if registration is enabled and the widget is exposed.
  • Affected Systems: Easy Elements for Elementor – Addons & Website Templates versions 1.4.5 and earlier on WordPress sites.
  • Immediate Action: Disable public registration now if not required, remove or hide the Login/Register widget, and update the plugin immediately.
  • Mitigation: Upgrade to the fixed version from the vendor, review all recently created users, and revoke any suspicious administrator accounts.

CVE-2026-4834: WP ERP Pro SQL Injection via search_key

  • Impact: Attackers could extract sensitive data from the database.
  • Affected Systems: WP ERP Pro versions 1.5.1 and earlier.
  • Immediate Action: Patch now and restrict public access to affected endpoints until confirmed safe.
  • Mitigation: Update to the vendor-fixed release, review database access logs, and watch for unusual query patterns or data export activity.

What to Do Now

  1. Patch the highest-risk systems first: Any exposed UniFi OS device, then affected WordPress sites using Easy Elements for Elementor or WP ERP Pro.
  2. Reduce exposure immediately: Remove direct internet access to admin panels, enforce VPN-only management, and disable unnecessary registration or public-facing widgets.
  3. Review privileged access: Check for unknown admin accounts, recent configuration changes, and unexpected plugin or device behavior.
  4. Validate remediation: Confirm installed versions, verify updates completed successfully, and ensure vulnerable plugins are no longer active.
  5. Escalate monitoring: Look for signs of command execution, file access anomalies, new WordPress admins, and suspicious database queries.

Verification steps: inventory all UniFi OS devices and WordPress plugins, confirm version numbers against vendor advisories, and review logs for new accounts, failed logins, and unusual POST requests.

Monitoring recommendations: alert on changes to admin roles, suspicious traversal strings, command execution indicators, and database query spikes. If any compromise is suspected, isolate the host and preserve logs before cleanup.

Related Resources

  • Internal: Upcoming internal blog post on Securing UniFi OS Management Interfaces.
  • Internal: Upcoming internal blog post on WordPress Plugin Exposure and Emergency Triage.
  • Official vendor advisories: Check Ubiquiti UniFi OS security advisories and the WordPress plugin vendor release notes for fixed versions.

Keep reading