Security Digest: June 8, 2026 - 19 Critical Vulnerabilities

Today’s alert is dominated by two critical WordPress remote-code-execution flaws and a broad set of publicly disclosed SQL injection issues affecting small business, education, and healthcare software. VMware Cloud Foundation Operations also has multiple stored XSS issues that can be used for admin takeover if a privileged user is tricked into viewing malicious content.

· 13 min read

June 8, 2026: Multiple Critical Exploits Demand Immediate Action

Executive Summary

Today’s alert is dominated by two critical WordPress remote-code-execution flaws and a broad set of publicly disclosed SQL injection issues affecting small business, education, and healthcare software. VMware Cloud Foundation Operations also has multiple stored XSS issues that can be used for admin takeover if a privileged user is tricked into viewing malicious content.

Act now: patch exposed systems first, disable risky upload and comment features where possible, and hunt for signs of webshells, database tampering, and unexpected admin actions.

Critical Vulnerabilities

CVE-2024-58349: WordPress Travelscape theme arbitrary file upload

  • Impact: Unauthenticated attackers can upload malicious files and achieve remote code execution on the WordPress server.
  • Affected Systems: WordPress Theme Travelscape 1.0.3.
  • Immediate Action: Remove or disable the theme on any internet-facing site until patched.
  • Mitigation: Update to a fixed release as soon as available; review theme directories for unexpected PHP files.

CVE-2024-58348: WordPress Background Image Cropper RCE via ups.php

  • Impact: Unauthenticated file upload can be used to run arbitrary PHP code on the server.
  • Affected Systems: WordPress plugin Background Image Cropper 1.2.
  • Immediate Action: Disable the plugin immediately and block access to ups.php.
  • Mitigation: Patch or remove the plugin; scan for uploaded webshells and new admin accounts.

CVE-2026-41724: VMware Cloud Foundation Operations stored XSS

  • Impact: A privileged attacker can inject scripts that trigger administrative actions.
  • Affected Systems: VMware Cloud Foundation Operations.
  • Immediate Action: Restrict policy/view/text-widget creation to trusted admins only.
  • Mitigation: Apply VMware updates; review recent content changes and admin activity.

CVE-2026-41722: VMware Cloud Foundation Operations stored XSS

  • Impact: Script injection may lead to session abuse or admin action execution.
  • Affected Systems: VMware Cloud Foundation Operations.
  • Immediate Action: Limit privileged content creation and audit recent submissions.
  • Mitigation: Patch immediately and validate that content sanitization is enabled.

CVE-2026-41723: VMware Cloud Foundation Operations stored XSS

  • Impact: Malicious scripts can be stored and later executed in admin browsers.
  • Affected Systems: VMware Cloud Foundation Operations.
  • Immediate Action: Treat all recently created widgets/views/policies as suspect.
  • Mitigation: Update to the vendor-fixed version and review admin logs.

CVE-2023-54350: WordPress Augmented-Reality plugin RCE

  • Impact: Unauthenticated attackers can upload and execute PHP files through the elFinder connector.
  • Affected Systems: WordPress plugin Augmented-Reality with the exposed connector endpoint.
  • Immediate Action: Disable the plugin and block connector.minimal.php immediately.
  • Mitigation: Patch/remove the plugin and inspect the file_manager directory for malicious files.

CVE-2026-11471: Class and Exam Timetabling System SQL injection

  • Impact: Remote attackers can inject SQL through the Password parameter and may steal or alter data.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0, /index2.php.
  • Immediate Action: Take the app offline if exposed to the internet.
  • Mitigation: Apply vendor or community fixes; validate database integrity and reset credentials if needed.

CVE-2026-11482: Class and Exam Timetabling System SQL injection

  • Impact: Remote SQL injection via sy in /archive5.php.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0.
  • Immediate Action: Restrict access and monitor for abnormal database queries now.
  • Mitigation: Patch the application and rotate any exposed database secrets.

CVE-2026-11483: Class and Exam Timetabling System SQL injection

  • Impact: Attackers can manipulate queries through sy in /archive4.php.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0.
  • Immediate Action: Block public access until remediation is complete.
  • Mitigation: Update immediately and review logs for database error spikes.

CVE-2026-11485: Class and Exam Timetabling System SQL injection

  • Impact: Remote SQL injection via sy in /archive2.php.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0.
  • Immediate Action: Disable the vulnerable endpoint if patching is delayed.
  • Mitigation: Apply the fix and review database permissions.

CVE-2026-11489: Online Music Site SQL injection

  • Impact: Remote attackers can inject SQL through the ID parameter and potentially alter admin data.
  • Affected Systems: code-projects Online Music Site 1.0, /Administrator/PHP/AdminDeleteAlbum.php.
  • Immediate Action: Restrict administrator endpoints behind authentication and IP controls.
  • Mitigation: Patch the app and check for unauthorized album or user changes.

CVE-2026-11484: Class and Exam Timetabling System SQL injection

  • Impact: Remote SQL injection via sy in /archive3.php.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0.
  • Immediate Action: Treat this as internet-exposed and urgent.
  • Mitigation: Patch, then verify no database records were modified.

CVE-2026-11486: Class and Exam Timetabling System SQL injection

  • Impact: Remote SQL injection via sy in /archive1.php.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0.
  • Immediate Action: Remove public exposure until fixed.
  • Mitigation: Apply the patch and review authentication and session logs.

CVE-2026-11488: Simple Flight Ticket Booking System SQL injection

  • Impact: Remote SQL injection through Username in checkUser.php.
  • Affected Systems: code-projects Simple Flight Ticket Booking System 1.0.
  • Immediate Action: Limit access to the login path and watch for credential attacks.
  • Mitigation: Patch the application and reset any exposed user credentials.

CVE-2026-11490: Online Music Site SQL injection

  • Impact: Remote SQL injection via Category in /Frontend/Search.php.
  • Affected Systems: code-projects Online Music Site 1.0.
  • Immediate Action: Filter traffic to the search endpoint and monitor for abuse.
  • Mitigation: Patch and test for unauthorized database reads.

CVE-2026-11501: Hospitals Patient Records Management System SQL injection

  • Impact: Remote SQL injection through ID in /classes/Master.php?f=save_patient.
  • Affected Systems: SourceCodester Hospitals Patient Records Management System 1.0.
  • Immediate Action: Treat as high priority due to potential patient-data exposure.
  • Mitigation: Patch immediately and review for unauthorized record changes.

CVE-2026-11474: student-management-system unrestricted upload

  • Impact: Remote attackers can upload arbitrary files through stimg, creating a path to server compromise.
  • Affected Systems: Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a.
  • Immediate Action: Disable public registration and any file upload path now.
  • Mitigation: Update to a fixed revision; inspect uploaded files and web directories.

CVE-2026-11472: Class and Exam Timetabling System SQL injection

  • Impact: Remote SQL injection via the Password parameter in /index1.php.
  • Affected Systems: SourceCodester Class and Exam Timetabling System 1.0.
  • Immediate Action: Assume active probing if the system is internet-facing.
  • Mitigation: Patch and review logs for credential theft or unauthorized access.

CVE-2023-54351: WordPress Sonaar Music stored XSS

  • Impact: Unauthenticated attackers can inject scripts into comments that execute in visitors’ browsers.
  • Affected Systems: WordPress Sonaar Music Plugin 4.7.
  • Immediate Action: Disable comments on affected playlist pages until patched.
  • Mitigation: Update the plugin and purge any stored malicious comments.

Previously Alerted

What to Do Now

  1. Patch or disable the two WordPress RCE exposures first, then the VMware XSS issues, then all public SQL injection targets.
  2. Remove internet exposure from vulnerable apps if fixes are not immediately available.
  3. Rotate credentials for systems that may have been reached through SQL injection or file upload abuse.
  4. Inspect for compromise: new admin users, webshells, changed templates, unexpected database edits, and suspicious outbound traffic.

Verification steps:

  • Confirm the affected product/version is present before and after remediation.
  • Check web roots and upload directories for new PHP files.
  • Review authentication, admin, and database logs for unusual activity in the last 30 days.

Monitoring recommendations:

  • Alert on POSTs to file-upload endpoints, ups.php, connector.minimal.php, and the listed PHP files.
  • Watch for SQL error bursts, new sessions, and changes to privileged accounts.
  • Monitor VMware admin actions tied to recently created policies, views, and text widgets.

Related Resources

  • Internal blog post: June 2026 Patch Prioritization for Internet-Facing Apps (coming soon)
  • Internal blog post: Detecting Webshells and SQL Injection Abuse in Shared Hosting (coming soon)
  • Official vendor advisories: WordPress plugin/theme maintainers, VMware security advisories, and SourceCodester/code-projects project notices

Keep reading