Security Digest: July 13, 2026 - 90 Critical Vulnerabilities

Today’s security picture is dominated by 90 critical and high-severity flaws, with the most urgent risks centered on WordPress plugin compromise, code injection, deserialization, SQL injection, path traversal, and authentication bypass. Several issues are rated CVSS 9.8–10 and could lead to remote code execution, full site takeover, or sensitive data exposure.

· 22 min read

July 13, 2026: 90 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s security picture is dominated by 90 critical and high-severity flaws, with the most urgent risks centered on WordPress plugin compromise, code injection, deserialization, SQL injection, path traversal, and authentication bypass. Several issues are rated CVSS 9.8–10 and could lead to remote code execution, full site takeover, or sensitive data exposure.

Act now: prioritize internet-facing WordPress sites, monitoring/OT systems, and any platform handling authentication, uploads, or admin workflows. Patch first, disable exposed vulnerable plugins where possible, and review logs for suspicious uploads, unexpected admin creation, and abnormal database activity.

Critical Vulnerabilities

  • CVE-2026-57719: Aimogen Pro dangerous file upload
    • Impact: Attackers can upload malicious files and potentially execute code on the server.
    • Affected Systems: CodeRevolution Aimogen Pro <= 2.8.3.
    • Immediate Action: Disable file upload features or the plugin until patched.
    • Mitigation: Update to the fixed version as soon as available; restrict upload MIME types and file execution on upload paths.
  • CVE-2026-57811: Realtyna Organic IDX code injection
    • Impact: Remote code inclusion can lead to full server compromise.
    • Affected Systems: Realtyna Organic IDX plugin <= 5.2.0.
    • Immediate Action: Remove from exposed sites if not immediately patchable.
    • Mitigation: Apply vendor patch; verify no untrusted file inclusion paths remain.
  • CVE-2026-57710: WoowBot Pro Max dangerous upload
    • Impact: Malicious file upload may lead to code execution.
    • Affected Systems: WoowBot Pro Max <= 14.1.7.
    • Immediate Action: Block public upload endpoints and audit recent uploads.
    • Mitigation: Patch immediately and scan for web shells.
  • CVE-2026-57401: SureDash path traversal
    • Impact: Attackers may read or reach restricted files and potentially chain to code execution.
    • Affected Systems: SureDash <= 1.8.0.
    • Immediate Action: Restrict access to the plugin and watch for unusual file access.
    • Mitigation: Update to the fixed release; block traversal patterns at the WAF.
  • CVE-2026-57813: MailOptin privilege escalation
    • Impact: Lower-privileged users may gain elevated access.
    • Affected Systems: MailOptin <= 1.2.77.3.
    • Immediate Action: Review admin and editor accounts for unexpected changes.
    • Mitigation: Patch now; remove unnecessary user roles and check audit logs.
  • CVE-2026-57738: 777 object injection
    • Impact: Deserialization flaws can enable code execution or privilege abuse.
    • Affected Systems: 777 <= 1.13.0.
    • Immediate Action: Disable the plugin if it is externally reachable.
    • Mitigation: Update immediately and hunt for unexpected object payloads.
  • CVE-2026-57770: Grand Photography object injection
    • Impact: Could enable remote compromise through unsafe deserialization.
    • Affected Systems: Grand Photography <= 5.7.8.
    • Immediate Action: Patch before further public exposure.
    • Mitigation: Upgrade and monitor for abnormal admin actions.
  • CVE-2026-59518: Directorist object injection
    • Impact: Unsafe deserialization may allow arbitrary code paths.
    • Affected Systems: Directorist <= 8.8.2.
    • Immediate Action: Treat as high priority on any directory/listing site.
    • Mitigation: Apply the vendor fix and review plugin logs.
  • CVE-2026-57724: Kirki object injection
    • Impact: Potential server compromise through crafted input.
    • Affected Systems: Kirki <= 6.0.12.
    • Immediate Action: Update all sites using Kirki-based themes/plugins.
    • Mitigation: Patch and scan for suspicious serialized payloads.
  • CVE-2026-57744: RT-Theme 18 Extensions object injection
    • Impact: May lead to code execution or data tampering.
    • Affected Systems: rt18-extensions <= 2.5.
    • Immediate Action: Disable if not critical to production.
    • Mitigation: Upgrade and verify no direct access to deserialization endpoints.
  • CVE-2026-4769: WAGO System I/O Field early-boot compromise
    • Impact: Unauthenticated remote attacker may gain full system compromise during boot window.
    • Affected Systems: Certain WAGO System I/O Field series devices.
    • Immediate Action: Restrict network exposure immediately.
    • Mitigation: Apply vendor guidance, segment OT networks, and monitor boot-time access attempts.
  • CVE-2026-14453: Centreon SSTI to RCE
    • Impact: Authenticated users can execute arbitrary code and expose secrets.
    • Affected Systems: Centreon-open-tickets module in Centreon Infra Monitoring.
    • Immediate Action: Limit module access to trusted admins only.
    • Mitigation: Patch immediately; review ticket content and server logs for template payloads.
  • CVE-2026-59515: AIWU blind SQL injection
    • Impact: Database extraction and account compromise are possible.
    • Affected Systems: AIWU <= 1.5.4.
    • Immediate Action: Put the app behind stricter access controls now.
    • Mitigation: Patch and inspect for unusual database queries.
  • CVE-2026-57702: Amelia blind SQL injection
    • Impact: Attackers can query or extract data from the database.
    • Affected Systems: Amelia <= 2.4.2.
    • Immediate Action: Prioritize booking systems exposed to the internet.
    • Mitigation: Update and monitor for slow, repeated query patterns.
  • CVE-2026-57739: AcyMailing SMTP Newsletter blind SQL injection
    • Impact: Data theft and account compromise risk.
    • Affected Systems: AcyMailing SMTP Newsletter <= 10.11.0.
    • Immediate Action: Patch mail systems first.
    • Mitigation: Upgrade and review database access logs.
  • CVE-2026-57714: LatePoint blind SQL injection
    • Impact: Database exposure and possible privilege escalation.
    • Affected Systems: LatePoint <= 5.6.3.
    • Immediate Action: Restrict booking/admin endpoints.
    • Mitigation: Apply vendor patch and test for injection signatures.
  • CVE-2026-57707: Simple Business Directory Pro SQL injection
    • Impact: Attackers may read or modify database contents.
    • Affected Systems: <= 15.9.4.
    • Immediate Action: Patch public directory sites immediately.
    • Mitigation: Upgrade and verify parameterized queries are in use.
  • CVE-2026-57726: Kirki blind SQL injection
    • Impact: Data extraction from affected sites.
    • Affected Systems: Kirki <= 6.0.12.
    • Immediate Action: Update alongside other Kirki fixes.
    • Mitigation: Patch and monitor for anomalous DB latency.
  • CVE-2026-57786: WorkScout-Core CSRF auth bypass
    • Impact: Attackers may bypass authentication through forged requests.
    • Affected Systems: WorkScout-Core <= 1.7.08.
    • Immediate Action: Restrict admin access and review session controls.
    • Mitigation: Patch and enforce CSRF protections site-wide.
  • CVE-2026-57386: aBlocks privilege escalation
    • Impact: Users may gain higher privileges than intended.
    • Affected Systems: aBlocks < 2.9.1.
    • Immediate Action: Audit recent role changes.
    • Mitigation: Upgrade and remove stale accounts.
  • CVE-2026-57410: MailerPress privilege escalation
    • Impact: Unauthorized elevation to admin-like access.
    • Affected Systems: MailerPress <= 2.0.2.
    • Immediate Action: Limit access until patched.
    • Mitigation: Update and verify role mapping.
  • CVE-2026-57709: Membership For WooCommerce path traversal
    • Impact: Restricted files may be exposed or abused in chained attacks.
    • Affected Systems: <= 3.1.0.
    • Immediate Action: Block suspicious file path requests now.
    • Mitigation: Patch and harden file access controls.
  • CVE-2026-57389: Groundhogg path traversal
    • Impact: File disclosure and possible downstream compromise.
    • Affected Systems: <= 4.4.1.
    • Immediate Action: Update on any customer-facing instance.
    • Mitigation: Apply fix and review web server access logs.
  • CVE-2026-57771: GD Rating System blind SQL injection
    • Impact: Database compromise risk.
    • Affected Systems: <= 3.7.
    • Immediate Action: Patch rating-enabled sites promptly.
    • Mitigation: Upgrade and monitor database error spikes.
  • CVE-2026-57385: Vitepos blind SQL injection
    • Impact: Sensitive data exposure and possible account takeover.
    • Affected Systems: <= 3.4.2.
    • Immediate Action: Treat POS-connected sites as urgent.
    • Mitigation: Patch and review transaction logs.
  • CVE-2026-57772: WP Inventory Manager blind SQL injection
    • Impact: Database theft or manipulation.
    • Affected Systems: <= 2.4.0.
    • Immediate Action: Restrict access until patched.
    • Mitigation: Update and validate input filtering.
  • CVE-2026-57810: APIExperts Square for WooCommerce blind SQL injection
    • Impact: Data compromise and potential code execution chain.
    • Affected Systems: <= 4.7.4.
    • Immediate Action: Patch immediately on commerce sites.
    • Mitigation: Upgrade and inspect for unusual API queries.
  • CVE-2026-57787: CWS SVGicons blind SQL injection
    • Impact: Database exposure.
    • Affected Systems: <= 1.5.5.
    • Immediate Action: Disable if not essential.
    • Mitigation: Patch and monitor for repeated probe traffic.
  • CVE-2026-57768: Houzez Login Register privilege escalation
    • Impact: Attackers may gain elevated access.
    • Affected Systems: <= 3.3.3.
    • Immediate Action: Review all recent registrations and role assignments.
    • Mitigation: Update and enforce stricter account approval.
  • CVE-2026-57773: Advanced Shipment Tracking SQL injection
    • Impact: Database compromise and potential downstream RCE chaining.
    • Affected Systems: <= 4.0.
    • Immediate Action: Patch shipping integrations now.
    • Mitigation: Upgrade and monitor for crafted query strings.
  • CVE-2026-61955: Persian Gravity Forms blind SQL injection
    • Impact: Data theft from form-processing workflows.
    • Affected Systems: <= 3.0.2.
    • Immediate Action: Patch and review form submission logs.
    • Mitigation: Update and rate-limit form endpoints.
  • CVE-2026-57729: Flatsome missing authorization
    • Impact: Unauthorized users may access restricted functions.
    • Affected Systems: <= 3.20.5.
    • Immediate Action: Audit all exposed Flatsome sites.
    • Mitigation: Patch and re-check access control settings.
  • CVE-2026-57378: Advanced Forms missing authorization
    • Impact: Attackers may access privileged actions without permission.
    • Affected Systems: <= 1.9.3.7.
    • Immediate Action: Lock down admin workflows.
    • Mitigation: Upgrade and verify role checks.
  • CVE-2026-57705: Event Tickets missing authorization
    • Impact: Unauthorized access to protected actions.
    • Affected Systems: <= 5.28.5.
    • Immediate Action: Patch event sites immediately.
    • Mitigation: Apply vendor fix and review permissions.
  • CVE-2026-57727: Kirki missing authorization
    • Impact: Access control bypass.
    • Affected Systems: Kirki <= 6.0.13.
    • Immediate Action: Update all Kirki deployments.
    • Mitigation: Patch and test admin-only routes.
  • CVE-2026-15584: OpenShift incluster-checks privilege escalation
    • Impact: Standard users may reach root on cluster nodes.
    • Affected Systems: OpenShift incluster-checks tool.
    • Immediate Action: Disable or restrict debug pod creation now.
    • Mitigation: Apply vendor guidance and isolate privileged namespaces.
  • CVE-2026-57697: ProfileGrid authentication bypass
    • Impact: Password recovery abuse may allow account takeover.
    • Affected Systems: <= 5.9.9.6.
    • Immediate Action: Reset exposed recovery flows.
    • Mitigation: Patch and review password reset activity.
  • CVE-2026-14165: Tuleap authorization bypass
    • Impact: Users may access other users’ data.
    • Affected Systems: Tuleap Enterprise Edition 17.0 through 17.5.
    • Immediate Action: Restrict access to sensitive projects immediately.
    • Mitigation: Upgrade and audit cross-user access logs.
  • CVE-2026-15574: vllm-orchestrator-gateway log exposure
    • Impact: Bearer tokens, headers, and chat payloads may be exposed in logs.
    • Affected Systems: vllm-orchestrator-gateway production binary.
    • Immediate Action: Rotate exposed secrets and lock down log access.
    • Mitigation: Patch logging behavior and purge sensitive logs.
  • CVE-2026-57815: Forminator path traversal
    • Impact: File access beyond intended directories.
    • Affected Systems: Forminator <= 1.55.0.2.
    • Immediate Action: Block suspicious path patterns.
    • Mitigation: Upgrade and verify upload/file handlers.
  • CVE-2026-15541: Isaiah missing authorization
    • Impact: Remote users may bypass authorization in websocket handling.
    • Affected Systems: Isaiah up to 1.36.9.
    • Immediate Action: Restrict websocket exposure.
    • Mitigation: Apply upstream fix when released.
  • CVE-2026-15517: Jinher OA SQL injection
    • Impact: Remote attackers can manipulate database queries.
    • Affected Systems: Jinher OA 1.0.
    • Immediate Action: Isolate the application if internet-facing.
    • Mitigation: Patch or remove the vulnerable component.
  • CVE-2026-15537: Online Book Store SQL injection
    • Impact: Credential and data theft.
    • Affected Systems: Online Book Store System 1.0.
    • Immediate Action: Take login endpoints under review now.
    • Mitigation: Apply fixes and rotate admin credentials.
  • CVE-2026-15542: Isaiah websocket auth flaw
    • Impact: Improper authentication may allow unauthorized access.
    • Affected Systems: Isaiah up to 1.36.9.
    • Immediate Action: Restrict access and monitor websocket sessions.
    • Mitigation: Upgrade when available.
  • CVE-2026-15514: MetaCRM SQL injection
    • Impact: Remote database compromise.
    • Affected Systems: MetaCRM up to 6.4.0 Beta06.
    • Immediate Action: Treat as exposed if publicly reachable.
    • Mitigation: Patch and inspect RPC endpoints.
  • CVE-2026-15557: waoowaoo improper authentication
    • Impact: Attackers may impersonate internal users.
    • Affected Systems: waoowaoo up to 0.4.1.
    • Immediate Action: Disable trust in client-supplied internal user headers.
    • Mitigation: Patch auth middleware and audit access logs.

What to Do Now

  1. Patch or disable immediately for all internet-facing WordPress plugins, OT devices, monitoring tools, and AI gateways listed above.
  2. Prioritize CVSS 9.8–10 issues first: file upload, code injection, deserialization, SSTI, and path traversal.
  3. Rotate credentials and secrets if any affected system may have logged tokens, headers, or chat content.
  4. Review admin and role changes for privilege escalation and authorization bypass signs.
  5. Hunt for exploitation by checking uploads, web shells, new admin accounts, suspicious SQL activity, and unusual file reads.

Verification steps: confirm plugin and package versions across production, staging, and customer-facing instances; compare against the affected ranges; validate that no vulnerable version remains exposed.

Monitoring recommendations: alert on new executable files in upload directories, repeated 500/SQL errors, unexpected outbound callbacks, boot-time access to OT assets, and access to logs containing bearer tokens or chat payloads.

Related Resources

  • Internal blog post: “Today’s WordPress plugin emergency: what to patch first” (to be published).
  • Internal blog post: “How to detect exploitation of SQL injection and file upload flaws” (to be published).
  • Official vendor advisories: WordPress plugin maintainers, WAGO, Centreon, OpenShift, and affected product vendors should be checked for fixed releases and mitigation notes.

Keep reading