Security Digest: May 28, 2026 - 13 Critical Vulnerabilities

Today’s alert is dominated by high-risk remote code execution, privilege escalation, and WordPress takeover flaws. The most urgent issues are in Comet Backup, Samba, Keycloak, and multiple widely used WordPress plugins that can let attackers take over admin accounts, run commands, upload web shells, or delete files.

· 11 min read

Executive Summary

Today’s alert is dominated by high-risk remote code execution, privilege escalation, and WordPress takeover flaws. The most urgent issues are in Comet Backup, Samba, Keycloak, and multiple widely used WordPress plugins that can let attackers take over admin accounts, run commands, upload web shells, or delete files. Patch or disable exposed features now, and treat any affected internet-facing system as urgent.

Critical Vulnerabilities

  • CVE-2026-32999: Comet Backup signing module code execution
    • Impact: An authenticated tenant admin can execute arbitrary code as a privileged user on the server and connected devices.
    • Affected Systems: Comet Backup server installations with the vulnerable backup agent signing module.
    • Immediate Action: Restrict tenant-admin access immediately and review all privileged tenant accounts.
    • Mitigation: Apply the vendor patch as soon as available; if you cannot patch today, disable or isolate tenant administration paths and review logs for suspicious signing activity.
  • CVE-2026-4408: Samba check password script command injection
    • Impact: Remote attackers can achieve command execution on affected Samba systems.
    • Affected Systems: Samba file servers and classic domain controllers using check password script with %u, especially when samba-dcerpcd runs as a system service.
    • Immediate Action: Check whether this non-standard configuration is in use and remove it immediately if so.
    • Mitigation: Update Samba to a fixed release; until then, stop using %u in the script and escape all username input.
  • CVE-2026-8915: Samsung Escargot out-of-bounds write
    • Impact: Potential remote code execution through memory corruption.
    • Affected Systems: Samsung Open Source Escargot at commit 36f5fb58366a67b713c02f6fd985e924fcc09e31.
    • Immediate Action: Identify any builds that include the affected commit and remove them from production use.
    • Mitigation: Rebuild from a patched revision and deploy vendor-provided fixes; monitor for crashes or unexpected process exits.
  • CVE-2026-7802: Frontend Admin authorization bypass to admin takeover
    • Impact: Authenticated attackers with subscriber access can overwrite admin profile fields, including passwords and email addresses.
    • Affected Systems: Frontend Admin by DynamiApps for WordPress, versions up to 3.29.2.
    • Immediate Action: Disable the plugin or remove public access to affected edit-user forms now.
    • Mitigation: Patch immediately; ensure the form’s Roles setting is not left empty and verify no admin accounts were modified.
  • CVE-2026-9009: Crawlomatic shortcode callback RCE
    • Impact: Authenticated authors can execute server-side commands through dangerous PHP callbacks.
    • Affected Systems: Crawlomatic Multipage Scraper Post Generator up to 2.7.2.
    • Immediate Action: Remove author-level access from untrusted users and disable the plugin if possible.
    • Mitigation: Update to a fixed version; block dangerous callbacks such as system, exec, shell_exec, and assert.
  • CVE-2026-9227: GutenBee arbitrary file upload
    • Impact: Authenticated attackers can upload executable files and potentially gain code execution.
    • Affected Systems: GutenBee – Gutenberg Blocks up to 2.20.1.
    • Immediate Action: Restrict author-level upload privileges and review recent media uploads for suspicious double extensions.
    • Mitigation: Patch immediately; block filenames that merely contain .json and enforce strict extension validation.
  • CVE-2026-6226: Frontend Admin unauthenticated privilege escalation
    • Impact: Unauthenticated attackers can create administrator accounts.
    • Affected Systems: Frontend Admin by DynamiApps up to 3.29.2.
    • Immediate Action: Treat this as a site takeover risk and disable exposed form endpoints now.
    • Mitigation: Patch immediately; verify no unexpected admin users were created and reset credentials if exposure is suspected.
  • CVE-2026-6455: WP Contact Form 7 DB Handler SQL injection and file deletion
    • Impact: CSRF plus SQL injection can lead to arbitrary file deletion, including wp-config.php.
    • Affected Systems: WP Contact Form 7 DB Handler up to 3.0.
    • Immediate Action: Remove the plugin from high-risk sites and force logout of privileged WordPress admins.
    • Mitigation: Patch immediately; enforce nonce checks, review admin actions, and look for unexpected file deletion or database anomalies.
  • CVE-2026-7797: Simply Schedule Appointments SQL injection
    • Impact: Unauthenticated attackers can extract sensitive database information.
    • Affected Systems: Appointment Booking Calendar / Simply Schedule Appointments up to 1.6.11.8.
    • Immediate Action: Restrict access to the /appointments/bulk endpoint at the edge if possible.
    • Mitigation: Update immediately; monitor for unusual PUT requests using form-encoded bodies and repeated timing-based probes.
  • CVE-2026-9795: Keycloak FGAPv2 role assignment bypass
    • Impact: Limited admins can assign highly privileged realm roles and escalate access.
    • Affected Systems: Keycloak deployments using Fine-Grained Admin Permissions (FGAPv2).
    • Immediate Action: Audit all delegated admin permissions and revoke unnecessary client-management rights.
    • Mitigation: Apply the Keycloak fix; verify client scope mappings and review tokens for unexpected role claims.
  • CVE-2026-2374: Login No Captcha stored XSS via PHP_SELF
    • Impact: Attackers can inject scripts that execute in the WordPress dashboard.
    • Affected Systems: Login No Captcha reCAPTCHA up to 1.8.0.
    • Immediate Action: Patch the plugin and watch for login attempts from unusual pages such as xmlrpc.php.
    • Mitigation: Update immediately; clear stored option data if needed and inspect dashboard notices for injected content.
  • CVE-2026-7052: HT Contact Form stored XSS via file uploads
    • Impact: Unauthenticated attackers can store scripts that execute for site visitors or admins.
    • Affected Systems: HT Contact Form – Drag & Drop Form Builder up to 2.8.2, when Store Submissions is enabled.
    • Immediate Action: Disable Store Submissions if not required and review recent form entries.
    • Mitigation: Patch immediately; sanitize uploaded values and replace unsafe rendering in the admin viewer.
  • CVE-2026-7634: SlimStat Analytics stored XSS via User-Agent
    • Impact: Attackers can inject scripts through the User-Agent header.
    • Affected Systems: SlimStat Analytics up to 5.4.11, when tooltip display is enabled.
    • Immediate Action: Disable show_complete_user_agent_tooltip until patched.
    • Mitigation: Update immediately; inspect analytics pages and logs for malformed User-Agent strings.

What to Do Now

  1. Patch or disable first: Prioritize Comet Backup, Samba, Keycloak, and all exposed WordPress plugins listed above.
  2. Reduce exposure: Remove unneeded author/subscriber privileges, disable risky plugin features, and block vulnerable admin endpoints at the firewall or reverse proxy.
  3. Verify compromise: Check for new admin users, unexpected password or email changes, suspicious uploads, file deletions, and abnormal command execution.
  4. Hunt for exploitation: Review web and application logs for unusual PUT requests, shortcode callback use, password reset abuse, and suspicious User-Agent or form submissions.
  5. Reset and recover: Rotate credentials, invalidate sessions, and restore any altered WordPress or backup server files from known-good backups.

Verification steps: Confirm plugin versions, compare installed packages against vendor advisories, and validate that exposed forms, bulk endpoints, and admin panels are not reachable by unauthenticated users.

Monitoring recommendations: Alert on new admin creation, privilege changes, shell command execution, web shell indicators, and outbound connections from backup, WordPress, Samba, and Keycloak servers.

Related Resources

  • Internal: Add links to your internal remediation playbooks and incident response notes for WordPress, Samba, Keycloak, and backup platform hardening.
  • Official vendor advisories: Monitor Comet Backup, Samba, Samsung Open Source Escargot, DynamiApps, WordPress plugin vendors, Keycloak, and plugin repository security notices for patched releases.

Keep reading