Security Digest: May 30, 2026 - 21 Critical Vulnerabilities

Today’s alert is dominated by authentication bypass, SQL injection, and WordPress plugin exploitation across widely deployed web apps and CMS add-ons. Several flaws are already public and easy to weaponize, so teams should patch exposed systems now, restrict admin access, and review logs for suspicious database queries and account activity.

· 13 min read

Executive Summary

Today’s alert is dominated by authentication bypass, SQL injection, and WordPress plugin exploitation across widely deployed web apps and CMS add-ons. Several flaws are already public and easy to weaponize, so teams should patch exposed systems now, restrict admin access, and review logs for suspicious database queries and account activity.

Priority one is any internet-facing WordPress site, student-management, guestbook, and portal applications listed below. If you run one of these products, treat it as actively at risk until patched or removed.

Critical Vulnerabilities

  • CVE-2026-7465: Spectra Gutenberg Blocks RCE
    • Impact: Authenticated attackers with Contributor-level access can execute code on the server.
    • Affected Systems: Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin, versions up to 2.19.25.
    • Immediate Action: Update immediately or disable the plugin if you cannot patch today. Review recent post content for suspicious block payloads.
    • Mitigation: Apply the vendor fix, remove untrusted contributor access, and audit for unexpected PHP execution or new admin users.
  • CVE-2018-25422: MOGG web simulator SQL injection
    • Impact: Unauthenticated attackers can extract database data via id in play.php.
    • Affected Systems: MOGG web simulator Script.
    • Immediate Action: Take the app offline or block access to play.php until patched.
    • Mitigation: Patch input handling, use parameterized queries, and monitor for unusual GET requests with SQL syntax.
  • CVE-2018-25416: AiOPMSD country.php SQL injection
    • Impact: Remote data theft through the country parameter.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Restrict public access and patch immediately.
    • Mitigation: Replace dynamic SQL with prepared statements and inspect logs for probing of country.php.
  • CVE-2018-25417: AiOPMSD quality.php SQL injection
    • Impact: Unauthenticated SQL execution through quality.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Isolate the system or block the endpoint now.
    • Mitigation: Patch, validate input, and rotate credentials if the database may have been exposed.
  • CVE-2018-25418: AiOPMSD year.php SQL injection
    • Impact: Database disclosure via year.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Patch immediately and review access logs.
    • Mitigation: Use prepared queries and apply WAF rules for injection patterns.
  • CVE-2018-25419: AiOPMSD genre.php SQL injection
    • Impact: Database extraction via genre.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Block public exposure until fixed.
    • Mitigation: Patch the application and search for abnormal query strings.
  • CVE-2018-25420: AiOPMSD watch.php SQL injection
    • Impact: Unauthenticated SQL execution through id.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Remove exposure from the internet or patch now.
    • Mitigation: Parameterize database access and reset any exposed credentials.
  • CVE-2018-25405: eNdonesia Portal mod.php SQL injection
    • Impact: Attackers can pull usernames, database names, and version info.
    • Affected Systems: eNdonesia Portal 8.7.
    • Immediate Action: Restrict access to mod.php and patch urgently.
    • Mitigation: Validate all module parameters and deploy WAF protections.
  • CVE-2018-25406: eNdonesia Portal mod.php SQL injection
    • Impact: Database and credential exposure across portal modules.
    • Affected Systems: eNdonesia Portal 8.7.
    • Immediate Action: Treat as exposed if internet-facing.
    • Mitigation: Upgrade, review database permissions, and monitor for repeated parameter tampering.
  • CVE-2018-25407: eNdonesia Portal mod.php SQL injection
    • Impact: Remote database querying through multiple parameters.
    • Affected Systems: eNdonesia Portal 8.7.
    • Immediate Action: Patch or disable public access now.
    • Mitigation: Use prepared statements and alert on suspicious mod.php activity.
  • CVE-2018-25424: Gate Pass Management System login bypass
    • Impact: Attackers can bypass authentication and gain application access.
    • Affected Systems: Gate Pass Management System 2.1.
    • Immediate Action: Take the login endpoint offline or patch immediately.
    • Mitigation: Fix SQL handling, force password resets, and review all recent logins.
  • CVE-2018-25425: Yot CMS SQL injection
    • Impact: Unauthorized database access through aid and cid.
    • Affected Systems: Yot CMS 3.3.1.
    • Immediate Action: Patch now and check for data exfiltration.
    • Mitigation: Replace unsafe queries and block malformed requests.
  • CVE-2018-25411: MGB OpenSource Guestbook SQL injection
    • Impact: Attackers can extract table and column names via id in email.php.
    • Affected Systems: MGB OpenSource Guestbook 0.7.0.2.
    • Immediate Action: Remove public access to the guestbook service if unpatched.
    • Mitigation: Patch and review for signs of database enumeration.
  • CVE-2018-25413: AiOPMSD search.php SQL injection
    • Impact: Database disclosure via q.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Patch immediately.
    • Mitigation: Apply prepared statements and inspect search traffic for injection strings.
  • CVE-2018-25414: AiOPMSD actor.php SQL injection
    • Impact: Remote SQL execution via actor.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Block or patch the endpoint now.
    • Mitigation: Validate inputs and rotate database credentials if exposure is suspected.
  • CVE-2018-25415: AiOPMSD director.php SQL injection
    • Impact: Database disclosure via director.
    • Affected Systems: AiOPMSD Final 1.0.0.
    • Immediate Action: Patch now and review logs.
    • Mitigation: Use parameterized queries and block direct access where possible.
  • CVE-2026-7459: Simple History account takeover
    • Impact: Authenticated users can read password reset email content and take over admin accounts when experimental features are enabled.
    • Affected Systems: Simple History – Track, Log, and Audit WordPress Changes up to 5.26.0.
    • Immediate Action: Disable experimental features, update immediately, and review for suspicious password-reset activity.
    • Mitigation: Patch, limit low-privilege users, and audit event reaction endpoints.
  • CVE-2026-9757: GEO my WP SQL injection
    • Impact: Unauthenticated attackers can append SQL and extract database data.
    • Affected Systems: GEO my WP up to 4.5.5 when the Posts Locator results shortcode is publicly exposed.
    • Immediate Action: Remove the public search-results page or patch immediately.
    • Mitigation: Upgrade, validate query handling, and watch for crafted query-string abuse.
  • CVE-2026-10110: Student Details Management System SQL injection
    • Impact: Remote SQL injection via roll in /index.php.
    • Affected Systems: code-projects Student Details Management System 1.0.
    • Immediate Action: Patch now; if impossible, isolate the app.
    • Mitigation: Use prepared statements and review for database scraping.
  • CVE-2026-10111: STUDENT-MANAGEMENT-SYSTEM login SQL injection
    • Impact: Remote SQL injection via email on the login page.
    • Affected Systems: sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0.
    • Immediate Action: Restrict access to the login page and patch immediately.
    • Mitigation: Replace vulnerable query logic and reset exposed credentials.
  • CVE-2018-25410: SIM-PKH admin SQL injection
    • Impact: Authenticated attackers can run arbitrary SQL through id in /admin/media.php.
    • Affected Systems: SIM-PKH 2.4.1.
    • Immediate Action: Limit admin access and patch now.
    • Mitigation: Sanitize inputs, use prepared queries, and review admin activity.

Previously Alerted

What to Do Now

  1. Patch or disable every exposed product above, starting with WordPress plugins and any internet-facing login or search pages.
  2. Restrict access to admin panels, guestbooks, portals, and student-management apps until updates are confirmed.
  3. Reset credentials if any vulnerable system may have been queried or if database access is uncertain.
  4. Verify exposure by checking whether the listed endpoints are publicly reachable and whether the vulnerable versions are installed.
  5. Hunt for abuse in web logs: repeated GET/POST requests, SQL metacharacters, unusual query strings, and unexpected password-reset events.
  6. Monitor for follow-on activity including new admin users, database dumps, webshells, and suspicious outbound connections.

Verification Steps

  • Confirm installed plugin/app versions against the affected ranges above.
  • Check whether the vulnerable endpoints are accessible from the internet.
  • Search logs for play.php, country.php, mod.php, login-exec.php, email.php, and WordPress REST event reaction requests.
  • Review database audit logs for UNION-based queries, stacked queries, and unexpected schema enumeration.

Monitoring Recommendations

  • Alert on spikes in 4xx/5xx responses for the affected endpoints.
  • Watch for new administrator accounts, password resets, and changes to plugin settings.
  • Enable WAF rules for SQL injection and block direct access to unused legacy apps.

Related Resources

  • Internal blog post on WordPress plugin hardening — coming soon.
  • Internal blog post on SQL injection detection in legacy PHP apps — coming soon.
  • Check official vendor advisories for each product and prioritize the latest patched release.

Keep reading