Security Digest: July 10, 2026 - 18 Critical Vulnerabilities

Today’s alert is broad and urgent: we’re seeing multiple unauthenticated remote code execution flaws in WordPress plugins, several authentication bypasses that can lead to full account takeover, and a handful of SQL injection, SSRF, path traversal, and data exposure issues across application platforms and AI tooling. If you run WordPress, LLM gateways, or any app parsing untrusted content, prioritize emergency patching now and assume exposed systems may already be targeted.

· 13 min read

Executive Summary

Today’s alert is broad and urgent: we’re seeing multiple unauthenticated remote code execution flaws in WordPress plugins, several authentication bypasses that can lead to full account takeover, and a handful of SQL injection, SSRF, path traversal, and data exposure issues across application platforms and AI tooling. If you run WordPress, LLM gateways, or any app parsing untrusted content, prioritize emergency patching now and assume exposed systems may already be targeted.

Immediate action: patch or disable affected components, rotate credentials where admin access may have been exposed, and review logs for suspicious file uploads, OAuth logins, SQL errors, and internal network access attempts.

Critical Vulnerabilities

  • CVE-2026-14894: Super Forms arbitrary file upload
    • Impact: Unauthenticated attackers can upload executable files and potentially gain remote code execution.
    • Affected Systems: Super Forms – Drag & Drop Form Builder for WordPress, versions up to and including 6.3.313.
    • Immediate Action: Remove or disable the plugin until patched; if it is public-facing, treat the site as high risk.
    • Mitigation: Update as soon as a fixed release is available; review uploads and web server logs for suspicious POST requests and new files.
  • CVE-2026-15282: Instant Appointment arbitrary file upload
    • Impact: Unauthenticated file upload may lead to remote code execution.
    • Affected Systems: Instant Appointment plugin for WordPress, versions up to and including 1.2.
    • Immediate Action: Disable the plugin on exposed sites now.
    • Mitigation: Patch immediately; inspect uploads directories for unexpected files.
  • CVE-2026-15378: guardrails-detectors blind SSRF
    • Impact: Remote attackers can trigger requests to internal services and metadata endpoints, exposing secrets and local files.
    • Affected Systems: guardrails-detectors component.
    • Immediate Action: Block outbound access to metadata and internal network ranges from affected services.
    • Mitigation: Apply the vendor fix; add egress filtering and monitor for requests to cloud metadata, Kubernetes, and MinIO endpoints.
  • CVE-2026-15300: GEO my WP SQL injection
    • Impact: Attackers can run injected SQL through proximity-search parameters and potentially extract data.
    • Affected Systems: GEO my WP plugin for WordPress, versions up to and including 4.5.4.
    • Immediate Action: Upgrade to 4.5.5 immediately.
    • Mitigation: Verify the fix is deployed and search logs for malformed query strings and time-based SQL probes.
  • CVE-2026-15070: Salon Booking System CSRF to code execution
    • Impact: A forged request can inject PHP into a web-accessible file, enabling remote code execution.
    • Affected Systems: Salon Booking System – Free Version, versions up to and including 10.30.32.
    • Immediate Action: Patch now and restrict admin browsing until fixed.
    • Mitigation: Require a fixed release; review translate-constants.php for tampering and audit admin actions.
  • CVE-2026-12598: LoginPress Pro Spotify authentication bypass
    • Impact: Attackers may log in as existing WordPress users, including administrators.
    • Affected Systems: LoginPress Pro up to and including 6.2.3, Spotify Social Login addon.
    • Immediate Action: Disable Spotify login immediately.
    • Mitigation: Update to a fixed version and force password resets for any accounts that may have been exposed.
  • CVE-2026-12595: LoginPress Pro Discord authentication bypass
    • Impact: Unverified Discord email values can be used to take over accounts, including admin accounts.
    • Affected Systems: LoginPress Pro up to and including 6.2.3.
    • Immediate Action: Disable Discord OAuth login now.
    • Mitigation: Patch immediately and review recent logins for OAuth-based access.
  • CVE-2026-12597: LoginPress Pro GitHub authentication bypass
    • Impact: Attackers may authenticate as matching WordPress users using an unverified GitHub email.
    • Affected Systems: LoginPress Pro up to and including 6.2.3.
    • Immediate Action: Disable GitHub login until patched.
    • Mitigation: Upgrade and audit account mappings for unexpected OAuth sign-ins.
  • CVE-2026-15293: WP Business Intelligence Lite authorization bypass
    • Impact: Subscribers and above can alter stored SQL queries, potentially leading to privilege escalation.
    • Affected Systems: WP Business Intelligence Lite up to and including 3.2.0.
    • Immediate Action: Restrict plugin access and patch immediately.
    • Mitigation: Verify query definitions and review admin views for tampering.
  • CVE-2026-33655: New API SSRF via notification URLs
    • Impact: Authenticated users can configure webhook targets that reach internal or metadata IPs.
    • Affected Systems: New API prior to 0.12.0-alpha.1.
    • Immediate Action: Disable custom notification URLs or enforce outbound filtering.
    • Mitigation: Upgrade to 0.12.0-alpha.1 and enable IP filtering for domains.
  • CVE-2026-59832: SiYuan sensitive file read
    • Impact: Authenticated attackers can read workspace secrets and document database files.
    • Affected Systems: SiYuan prior to 3.7.1.
    • Immediate Action: Restrict access to the snippets route and patch now.
    • Mitigation: Upgrade to 3.7.1; review access to /snippets/ paths.
  • CVE-2026-49851: Mistune CPU exhaustion DoS
    • Impact: Small crafted Markdown payloads can consume excessive CPU and slow or crash services.
    • Affected Systems: mistune Python package.
    • Immediate Action: Limit or pre-filter user-supplied Markdown.
    • Mitigation: Upgrade to a fixed release when available; add request size and rate limits.
  • CVE-2026-15290: Ultimate Member blind SQL injection
    • Impact: Unauthenticated attackers can inject SQL through search parameters and extract sensitive data.
    • Affected Systems: Ultimate Member plugin for WordPress, versions up to and including 2.10.1.
    • Immediate Action: Patch immediately and monitor search endpoints.
    • Mitigation: Apply the vendor fix and look for time-based SQL payloads in logs.
  • CVE-2026-15291: Chat Help data exposure
    • Impact: Unauthenticated attackers can access leads, personal data, geolocation, and user details via REST endpoints.
    • Affected Systems: Chat Help plugin for WordPress, versions up to and including 3.1.3.
    • Immediate Action: Block public access to the REST endpoints now.
    • Mitigation: Patch immediately and review whether exposed lead data must be treated as compromised.
  • CVE-2026-59834: SiYuan search SQL injection
    • Impact: Attackers can inject SQL and return rows from hidden documents.
    • Affected Systems: SiYuan prior to 3.7.1.
    • Immediate Action: Restrict publish-visitor access and patch now.
    • Mitigation: Upgrade to 3.7.1 and audit search-related requests.
  • CVE-2026-15298: TelSender DOM XSS
    • Impact: Malicious Telegram chat titles can execute scripts in an admin’s browser.
    • Affected Systems: TelSender plugin for WordPress, versions up to and including 1.14.14.
    • Immediate Action: Avoid opening the settings page until patched.
    • Mitigation: Update immediately and review admin sessions for suspicious activity.
  • CVE-2026-13430: Post Export Import with Media arbitrary file upload
    • Impact: Authenticated administrators can upload files that may be executable, enabling remote code execution.
    • Affected Systems: Post Export Import with Media plugin for WordPress, versions up to and including 1.13.1.
    • Immediate Action: Patch now and review recent imports.
    • Mitigation: Verify file-extension checks are fixed and inspect uploads for trailing-dot filenames.
  • CVE-2026-50181: Langroid path traversal
    • Impact: Tool callers can read or write files outside the intended working directory.
    • Affected Systems: Langroid prior to 0.64.0.
    • Immediate Action: Disable exposed file tools or confine them to trusted users only.
    • Mitigation: Upgrade to 0.64.0 and verify path enforcement in any agent workflow.

Previously Alerted

What to Do Now

  1. Patch or disable affected plugins and packages immediately, starting with WordPress plugins that allow unauthenticated upload, login bypass, or SQL injection.
  2. Assume compromise where admin access may have been exposed; force password resets, revoke sessions, and rotate API keys and OAuth credentials.
  3. Block risky outbound traffic from affected services to metadata IPs, internal networks, and other sensitive endpoints.
  4. Review logs for signs of exploitation: suspicious uploads, new PHP files, OAuth logins, SQL error patterns, and requests to /snippets/ or REST data endpoints.
  5. Contain public-facing exposure by temporarily disabling vulnerable features, forms, login providers, and file tools until updates are confirmed.

Verification steps: confirm installed versions against the vulnerable ranges above, check that fixes are actually deployed in production, and validate that disabled features remain inaccessible. For WordPress, verify plugin directories for unexpected files and compare admin accounts and recent sessions against known-good baselines.

Monitoring recommendations: alert on new executable uploads, unusual POSTs to AJAX handlers, time-based SQL payloads, OAuth callbacks from unexpected providers, outbound requests to cloud metadata services, and repeated Markdown or document parsing spikes that may indicate DoS attempts.

Related Resources

  • Internal blog post on WordPress emergency patching and account takeover response — coming soon.
  • Internal blog post on SSRF containment for AI and automation platforms — coming soon.
  • Official vendor advisories and release notes for each affected product, including WordPress plugin updates, SiYuan 3.7.1, New API 0.12.0-alpha.1, Langroid 0.64.0, and the latest Mistune fix.

Keep reading