Security Digest: June 6, 2026 - 6 Critical Vulnerabilities

Today’s threat picture is dominated by publicly disclosed exploits, WordPress plugin takeover paths, and remote attack vectors that can lead to data theft, account compromise, or full server control. Security teams should prioritize exposed internet-facing systems, WordPress admin panels, and any JD Cloud Box or Jinher OA deployments, then patch, disable vulnerable features, and review logs immediately.

· 8 min read

Today's Critical Security Alert: 6 High-Risk Vulnerabilities Requiring Immediate Action

Executive Summary

Today’s threat picture is dominated by publicly disclosed exploits, WordPress plugin takeover paths, and remote attack vectors that can lead to data theft, account compromise, or full server control. Security teams should prioritize exposed internet-facing systems, WordPress admin panels, and any JD Cloud Box or Jinher OA deployments, then patch, disable vulnerable features, and review logs immediately.

Critical Vulnerabilities

CVE-2026-11413: JD Cloud Box AX6600 stack-based buffer overflow

Impact: Remote attackers can trigger a stack-based buffer overflow in /sbin/jdcweb_rpc, potentially causing device compromise. The exploit is already public, which raises the chance of active abuse.

Affected Systems: JingDong JD Cloud Box AX6600 4.5.3.r4546

Immediate Action: Remove exposure from the internet if possible, restrict management access to trusted networks only, and treat affected devices as high priority for replacement or vendor remediation.

Mitigation: Apply a vendor fix if one becomes available; otherwise isolate the device, block remote admin access, and monitor for abnormal RPC traffic and unexpected reboots.

CVE-2026-11435: Jinher OA SQL injection in nextselectplan.aspx

Impact: Remote attackers can inject SQL through the httpOID parameter, risking data disclosure, tampering, and possible database takeover.

Affected Systems: Jinher OA 1.0

Immediate Action: Disable external access to the application, review all requests to nextselectplan.aspx, and assume the database may be probed or abused if the service is exposed.

Mitigation: Apply a patch from the vendor if released; until then, place the app behind strict access controls and use web application firewall rules to block suspicious SQL patterns.

CVE-2026-8438: AIOS WordPress plugin stored XSS via debug logs

Impact: An unauthenticated attacker can inject script that runs in an administrator’s browser when debug logs are viewed. That can lead to nonce theft, unauthorized actions, and possible full site compromise.

Affected Systems: All-In-One Security (AIOS) – Security and Firewall plugin for WordPress up to and including 5.4.7, especially when aiowps_disallow_unauthorized_rest_requests and aiowps_enable_debug are enabled

Immediate Action: Disable debug logging now, review whether REST restrictions are enabled, and upgrade the plugin immediately.

Mitigation: Update to the fixed version as soon as available; until then, keep debug logs off and limit admin access to trusted users and IPs.

CVE-2026-8901: Freshsales integration plugin stored XSS in error logs

Impact: Attackers can plant malicious scripts in submitted form data that execute when an admin opens the CRM error log modal, creating a path to admin-session abuse.

Affected Systems: Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More up to and including 1.0.15

Immediate Action: Upgrade the plugin immediately and review any recent failed CRM API calls or suspicious form submissions.

Mitigation: Patch to the vendor-fixed release; temporarily restrict access to admin log views and monitor for unusual form payloads.

CVE-2026-7537: MDJM Event Management arbitrary file upload

Impact: Authenticated administrators can upload files without type checks, which may allow executable files and lead to remote code execution.

Affected Systems: MDJM Event Management plugin for WordPress up to and including 1.7.8.3

Immediate Action: Update immediately and audit all recent uploads handled through mdjm_send_comm_email.

Mitigation: Remove or disable the plugin if you cannot patch quickly; enforce server-side upload restrictions and scan uploaded files for web shells.

CVE-2026-9851: Booking Package privilege escalation to full admin takeover

Impact: Authenticated users with Editor-level access and above can change another user’s email and password, including Administrator accounts, resulting in full site takeover.

Affected Systems: Booking Package plugin for WordPress up to and including 1.7.16

Immediate Action: Update immediately, review all recent account changes, and reset credentials for any account touched by the plugin.

Mitigation: Patch to the fixed version; if patching is delayed, restrict plugin access, audit the package_app_action endpoint, and force password resets for privileged users.

What to Do Now

  1. Patch or isolate all affected systems today, starting with anything internet-facing or used by administrators.
  2. Disable risky features immediately: WordPress debug logging, exposed REST/admin paths, and any unnecessary file upload workflows.
  3. Review accounts and logs for signs of XSS abuse, unexpected password resets, SQL injection attempts, and suspicious uploads.
  4. Reset credentials for privileged WordPress users if there is any chance of exposure.

Verification steps:

  • Confirm plugin and application versions match the affected ranges listed above.
  • Check whether the vulnerable WordPress plugins are active on production sites, staging sites, and multisite networks.
  • Validate that remote administration for the JD Cloud Box and Jinher OA systems is not exposed to the public internet.

Monitoring recommendations:

  • Watch for unusual admin logins, password resets, and account profile changes.
  • Alert on requests to nextselectplan.aspx, package_app_action, and suspicious REST/debug log activity.
  • Scan for web shell uploads, unexpected JavaScript in logs, and new outbound connections from affected hosts.

Related Resources

  • Internal: See the upcoming internal blog post series on WordPress plugin abuse prevention and internet-facing application hardening.
  • Official vendor advisories: Monitor advisories from JingDong JD Cloud, Jinher, and the WordPress plugin maintainers for fix releases and cleanup guidance.

Keep reading