Security Digest: May 29, 2026 - 7 Critical Vulnerabilities

Today’s alerts are dominated by WordPress authentication bypass and privilege escalation flaws, plus high-risk issues in a VMS platform, Mautic, and several widely used plugins. The immediate priority is to patch exposed WordPress sites, disable risky plugin features where possible, and verify admin accounts and logs for suspicious changes.

· 8 min read

Executive Summary

Today’s alerts are dominated by WordPress authentication bypass and privilege escalation flaws, plus high-risk issues in a VMS platform, Mautic, and several widely used plugins. The immediate priority is to patch exposed WordPress sites, disable risky plugin features where possible, and verify admin accounts and logs for suspicious changes.

If you run any affected product, treat these issues as active takeover risks rather than routine bugs. Attackers can move from unauthenticated access to full admin control on some systems, so speed matters.

Critical Vulnerabilities

CVE-2026-3655: WordPress OTP Login Authentication Bypass

  • Impact: Unauthenticated attackers can log in as any user with a stored phone number, including administrators.
  • Affected Systems: OTP Login With Phone Number, OTP Verification plugin for WordPress versions 1.8.50 through 1.8.60.
  • Immediate Action: Disable the plugin now if you cannot confirm you are on a fixed release. Review all recent logins and admin changes.
  • Mitigation: Update to the vendor-fixed version as soon as it is available; restrict access to wp-admin and monitor for unauthorized account use.

CVE-2026-8732: WP Maps Pro Admin Account Creation

  • Impact: Unauthenticated attackers can create a new WordPress administrator account and fully take over the site.
  • Affected Systems: WP Maps Pro up to and including 6.1.0.
  • Immediate Action: Assume compromise risk on any public-facing site with this plugin installed. Remove or disable the plugin immediately if patching is not confirmed.
  • Mitigation: Apply the vendor update when released; check for unknown admin users and suspicious login URLs.

CVE-2025-11993: WooCommerce Infinite Scroll and Ajax Pagination PHP Object Injection

  • Impact: Authenticated attackers with low privileges can inject PHP objects, which may lead to code execution depending on other installed components.
  • Affected Systems: WooCommerce Infinite Scroll and Ajax Pagination up to and including 1.8.
  • Immediate Action: Remove access for Subscriber-level users if possible until patched; review who can import settings.
  • Mitigation: Update immediately and audit for dangerous plugin/theme combinations that could provide a POP chain.

CVE-2026-6075: Media Library Assistant CSRF on Bulk Actions

  • Impact: Attackers can trick an administrator into deleting, editing, or purging plugin settings and attachment metadata.
  • Affected Systems: Media Library Assistant up to and including 3.35.
  • Immediate Action: Warn administrators not to click unknown links and restrict admin sessions until patched.
  • Mitigation: Upgrade to a fixed version; review recent bulk media actions and settings changes.

CVE-2026-10056: Nx Witness VMS CORS Session Theft

  • Impact: A malicious web page can steal session tokens and take over an administrator account.
  • Affected Systems: Network Optix Nx Witness VMS before 6.1.2 in Standard security mode on Linux and Windows.
  • Immediate Action: Change to High security mode or apply the workaround now if you cannot upgrade immediately.
  • Mitigation: Update to 6.1.2 or later. Workaround: set supportedOrigins to null via PATCH /rest/v2/system/settings with {"supportedOrigins":"null"}.

CVE-2025-11262: Link Whisper Free Stored XSS

  • Impact: Attackers can inject scripts that run when users view affected pages, enabling session theft or admin actions.
  • Affected Systems: Link Whisper Free up to and including 0.9.0.
  • Immediate Action: Search for suspicious content in pages and plugin-managed output; disable the plugin if you cannot patch quickly.
  • Mitigation: Update to the fixed release and recheck user-generated or imported content for injected scripts.

CVE-2026-4776: Mautic API SQL Injection

  • Impact: An authenticated API user can inject SQL and potentially read, modify, or damage data.
  • Affected Systems: Mautic API contact filtering in affected versions; exact fixed release not provided in this alert.
  • Immediate Action: Restrict API access immediately and review all API credentials and recent contact-filter requests.
  • Mitigation: Apply the vendor patch once available; rotate API keys and monitor database activity for unusual queries.

What to Do Now

  1. Patch or disable the affected plugins and platforms immediately, starting with the two WordPress takeover bugs and Nx Witness.
  2. Check for compromise: review admin users, recent logins, plugin settings changes, and unexpected API activity.
  3. Limit exposure: restrict wp-admin, API access, and administrative roles until updates are verified.

Verification steps:

  • Confirm installed versions against the affected ranges listed above.
  • Look for unknown WordPress administrators, new login sessions, and altered plugin settings.
  • Review web server, application, and database logs for suspicious requests to AJAX handlers, import endpoints, and API filters.

Monitoring recommendations:

  • Alert on new admin user creation, privilege changes, and unusual login URLs.
  • Watch for cross-origin requests, unexpected CORS behavior, and token reuse in Nx Witness.
  • Track outbound traffic, injected scripts, and abnormal SQL patterns tied to Mautic API use.

Related Resources

  • Internal: Refer to the pending internal blog post on today’s WordPress takeover risks.
  • Internal: Refer to the pending internal blog post on CORS and session-theft exposure in VMS deployments.
  • Official vendor advisories: Check the WordPress plugin repositories, Network Optix security advisory page, and Mautic release/security notes for fixes and confirmations.

Keep reading