Security Digest: June 5, 2026 - 6 Critical Vulnerabilities

Six high-impact vulnerabilities disclosed today affect WordPress plugins, container infrastructure, automation tooling, industrial devices, and a public-facing reservation system. The most urgent risks are CVE-2026-49777 in Product Slider Pro for WooCommerce with CVSS 10, and CVE-2026-6274 in Redline WR3200, both of which can lead to full compromise or unauthorized access.

· 9 min read

Today's Critical Security Threats Demand Immediate Action

Executive Summary

Six high-impact vulnerabilities disclosed today affect WordPress plugins, container infrastructure, automation tooling, industrial devices, and a public-facing reservation system. The most urgent risks are CVE-2026-49777 in Product Slider Pro for WooCommerce with CVSS 10, and CVE-2026-6274 in Redline WR3200, both of which can lead to full compromise or unauthorized access.

Teams should patch or remove exposed systems now, verify whether vendor fixes are actually installed, and restrict access to admin, automation, and container-management interfaces until remediation is complete.

Critical Vulnerabilities

CVE-2026-49777: Product Slider Pro for WooCommerce allows remote code execution

  • Impact: Attackers can implant malicious software and potentially gain full control of the affected WordPress site.
  • Affected Systems: ShapedPlugin, LLC Product Slider Pro for WooCommerce versions before 3.5.3. The vendor has applied a fix to an existing release without publishing a new version, so installations cannot be reliably identified as patched.
  • Immediate Action: Treat all installations as vulnerable until independently verified. Disable the plugin if you cannot confirm the fix, and inspect all WordPress sites using this plugin for compromise.
  • Mitigation: Apply the vendor-provided fix only if you can verify the patched code is present. Otherwise, remove the plugin, restore from known-good backups, and rotate credentials for WordPress admin, database, and hosting access.

CVE-2026-6274: Redline WR3200 missing authentication on critical functions

  • Impact: Remote attackers may access functions that should be blocked by access controls, potentially leading to device takeover or service disruption.
  • Affected Systems: DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 from 7.1.3 before 7.1.8.
  • Immediate Action: Upgrade immediately to 7.1.8 or later and restrict management access to trusted networks only.
  • Mitigation: If patching is delayed, isolate the device, block internet exposure, and review admin accounts and configuration changes for unauthorized activity.

CVE-2026-11332: ansible-core role install can be abused for code execution

  • Impact: A malicious role author can inject git configuration flags and execute arbitrary code on the machine running ansible-galaxy role install.
  • Affected Systems: ansible-core users installing roles from untrusted or third-party sources.
  • Immediate Action: Stop installing roles from untrusted sources and review pipelines that automatically fetch Ansible content.
  • Mitigation: Pin roles to trusted sources, inspect meta/requirements.yml before installation, and update ansible-core as soon as a fixed release is available from the vendor.

CVE-2026-10877: Ship Ferry Ticket Reservation System admin login SQL injection

  • Impact: Remote attackers can exploit the admin login flow to run SQL injection attacks, potentially stealing data or bypassing authentication.
  • Affected Systems: SourceCodester Ship Ferry Ticket Reservation System up to 1.0, specifically /admin/login.php.
  • Immediate Action: Assume public exploitability. Remove internet exposure from the admin portal and apply input-validation and query-safety fixes immediately.
  • Mitigation: Deploy a patched build if available, otherwise place the application behind VPN or IP allowlisting, and review database and admin logs for suspicious login attempts.

CVE-2026-10586: Gutenberg Essential Blocks SSRF in AI image function

  • Impact: Authenticated attackers with Author-level access or higher can make the server send requests to arbitrary locations, including internal services.
  • Affected Systems: WordPress Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns versions up to and including 6.1.3.
  • Immediate Action: Upgrade beyond 6.1.3 now and review whether lower-trust WordPress accounts have Author access.
  • Mitigation: Restrict editor roles, disable the vulnerable feature if possible, and monitor outbound requests from the web server for signs of internal probing.

CVE-2026-41567: Docker archive handling can execute trojanized decompression binaries

  • Impact: A malicious container image can lead to arbitrary code execution with full daemon privileges, including host root access, when compressed archives are copied into the container.
  • Affected Systems: Moby prior to 29.5.1 and moby/moby v2 prior to v2.0.0-beta.14.
  • Immediate Action: Upgrade Docker Engine to 29.5.1 or later and stop using docker cp - or PUT /containers/{id}/archive against untrusted containers.
  • Mitigation: Use only trusted images, restrict archive upload access with authorization controls, and avoid compressed archive transfers into containers from unknown sources.

What to Do Now

  1. Patch or disable exposed products immediately starting with WordPress plugins, Docker/Moby, and Redline WR3200 devices.
  2. Verify actual fix status for Product Slider Pro for WooCommerce, since the vendor fix was released without a new version number.
  3. Block or restrict administrative interfaces for WordPress, Ansible automation endpoints, and the ferry reservation admin portal.
  4. Assume compromise where public exploits exist and check logs, file integrity, and recent admin changes.
  5. Rotate credentials and tokens for affected web apps, CI/CD systems, and container-management access if any exposure is confirmed.

Verification steps:

  • Confirm installed versions against the affected ranges listed above.
  • Check whether the WordPress plugin fix is present by reviewing the deployed code, not just the reported version.
  • Review Docker host update status and confirm the daemon is at 29.5.1 or newer.
  • Audit Ansible role sources and remove any untrusted dependencies from automation workflows.

Monitoring recommendations:

  • Watch for unexpected admin logins, new accounts, and configuration changes.
  • Alert on outbound requests from WordPress servers to internal IP ranges or metadata services.
  • Monitor container hosts for unusual binary execution, archive handling, or daemon privilege escalation attempts.
  • Track failed login bursts and SQL error patterns on exposed applications.

Related Resources

  • Internal: Refer to the planned June 5, 2026 internal response brief on WordPress, container, and automation exposure.
  • Official vendor advisories: ShapedPlugin Product Slider Pro for WooCommerce, DTS Electronics Redline WR3200, Red Hat ansible-core advisory, SourceCodester application notice, WordPress plugin release notes, and Docker/Moby security advisory for CVE-2026-41567.

Keep reading