Security Digest: July 17, 2026 - 33 Critical Vulnerabilities

Today’s threat picture is broad and urgent: we have multiple unauthenticated takeover paths in WordPress and API tooling, plus a concentrated cluster of authorization bypasses in OpenClaw that could let lower-trust users break out of intended controls. Several issues also expose secrets directly, including JWT forgery, token leakage, and permissive CORS that can turn a single stolen token into full account abuse.

· 9 min read

Executive Summary

Today’s threat picture is broad and urgent: we have multiple unauthenticated takeover paths in WordPress and API tooling, plus a concentrated cluster of authorization bypasses in OpenClaw that could let lower-trust users break out of intended controls. Several issues also expose secrets directly, including JWT forgery, token leakage, and permissive CORS that can turn a single stolen token into full account abuse.

Act now: patch exposed internet-facing systems first, disable or restrict vulnerable features where you can, and rotate any credentials that may have been exposed through logs, URLs, or API responses.

Critical Vulnerabilities

  • CVE-2026-15982: Aimogen Pro privilege escalation
    • Impact: Unauthenticated attackers can create administrator accounts and execute arbitrary PHP functions.
    • Affected Systems: Aimogen Pro plugin for WordPress up to and including 2.8.4.
    • Immediate Action: Remove or disable the plugin on exposed sites until patched.
    • Mitigation: Update to a fixed release as soon as available; review admin accounts for unauthorized creation.
  • CVE-2026-62241: clawvet JWT secret exposure and account forgery
    • Impact: Attackers can forge sessions, read victim emails, subscription data, and secret API keys.
    • Affected Systems: clawvet self-hosted API server before 0.7.5.
    • Immediate Action: Rotate the JWT secret immediately and block unauthenticated access to scan endpoints.
    • Mitigation: Upgrade to 0.7.5 or later; invalidate existing sessions and rotate exposed API keys.
  • CVE-2026-13352: ProfilePress arbitrary file upload
    • Impact: Authenticated attackers with author-level access can upload executable files, enabling remote code execution.
    • Affected Systems: ProfilePress up to and including 4.16.18.
    • Immediate Action: Restrict author uploads and disable the plugin if it is not essential.
    • Mitigation: Update immediately; audit upload directories for executable files.
  • CVE-2026-62233: Grav plugin API super-admin escalation
    • Impact: Non-super admins can become super-admins, mint powerful API keys, and disable 2FA.
    • Affected Systems: grav-plugin-api before 1.0.6.
    • Immediate Action: Upgrade the plugin now and review all API keys created recently.
    • Mitigation: Patch to 1.0.6; rotate keys and re-enable 2FA where needed.
  • CVE-2026-62386 / CVE-2026-62387 / CVE-2026-62230 / CVE-2026-62232: Grav API and login exposure chain
    • Impact: Tokens can leak via URLs, logs, Referer headers, and permissive CORS; 2FA can be bypassed; sensitive files can be read on case-insensitive systems.
    • Affected Systems: grav-plugin-api before 1.0.0-rc.16; Grav before 2.0.4.
    • Immediate Action: Stop passing tokens in URLs, rotate any exposed tokens, and patch Grav immediately.
    • Mitigation: Upgrade to fixed versions; tighten CORS and verify 2FA flows.
  • CVE-2026-34150 / CVE-2026-39359: Wazuh manager compromise and alert-processing outage
    • Impact: Attackers can crash analysisd and stop alert processing; one flaw also exposes internal files during agent sync.
    • Affected Systems: Wazuh prior to 4.14.5, and affected 4.10.x/4.11.x/4.14.x ranges.
    • Immediate Action: Patch immediately, especially if using default docker deployments; restrict agent enrollment.
    • Mitigation: Upgrade to 4.14.5 or the vendor-fixed versions; monitor for stale dashboard data.
  • OpenClaw cluster: CVE-2026-62201, 62202, 62203, 62205, 62206, 62207, 62209, 62212, 62215, 62217, 62218, 62219, 62222, 62223, 62226, 62228, 62229
    • Impact: Multiple authorization bypasses, privilege escalations, policy escapes, and internal network access paths can let lower-trust callers perform admin-like actions.
    • Affected Systems: Various OpenClaw releases before the listed fixed versions, including 2026.5.x, 2026.6.x, and beta builds.
    • Immediate Action: Disable exposed agent/exec/approval features you do not actively use and patch all instances in priority order.
    • Mitigation: Upgrade to the first fixed release for each issue; review gateway/node environment parity and input-path exposure.
  • CVE-2026-43977 / CVE-2026-43978: wger data exposure and trainer escalation
    • Impact: Private workout history can be read by other users, and trainers can escalate to higher-privileged accounts.
    • Affected Systems: wger versions prior to 2.6.
    • Immediate Action: Patch to 2.6 and review access to member records immediately.
    • Mitigation: Upgrade to 2.6; audit for unauthorized account switches and unusual data access.
  • CVE-2026-44436: Quicly connection-state corruption
    • Impact: Remote attackers can trigger denial of service and assertion failures in applications using the library without their own CID checks.
    • Affected Systems: Quicly prior to commit 8b178e6.
    • Immediate Action: Update the library or apply the upstream commit immediately.
    • Mitigation: Enforce CID length checks in any application using Quicly.
  • CVE-2026-15395: Kali Forms stored XSS
    • Impact: Unauthenticated attackers can inject scripts that execute when a page is viewed.
    • Affected Systems: Kali Forms up to and including 2.4.18.
    • Immediate Action: Disable the form or remove the shortcode from public pages until patched.
    • Mitigation: Update immediately; review submitted form content for malicious payloads.

Note: The remaining OpenClaw, Grav, Wazuh, wger, and WordPress issues in today’s set are all high-risk and should be treated as patch-now items if the affected feature is reachable in your environment.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first. Prioritize WordPress plugins, Grav, Wazuh, OpenClaw, and any API servers exposed to the public internet.
  2. Disable risky features until fixed. Turn off exposed exec, approval, webhook, upload, and token-in-URL flows where possible.
  3. Rotate secrets and invalidate sessions. Assume compromise if tokens, JWT secrets, or API keys may have been exposed.
  4. Review admin and super-admin accounts. Look for newly created accounts, unexpected 2FA changes, and unusual API key creation.
  5. Check logs and network paths. Search for token leakage in URLs, Referer headers, proxy logs, and unusual outbound requests.

Verification steps:

  • Confirm versions against vendor advisories and package manifests.
  • Check whether vulnerable plugins or features are enabled, not just installed.
  • Inspect recent authentication and privilege-change events for each affected platform.

Monitoring recommendations:

  • Alert on new admin creation, 2FA reset, and API key issuance.
  • Watch for repeated failed auth followed by success, especially on API and approval endpoints.
  • Monitor for unexpected file uploads, uppercase file-extension access, and token-bearing URLs.

Related Resources

  • Internal blog posts: add a roundup on WordPress plugin risk, API token leakage, and OpenClaw authorization failures.
  • Official vendor advisories: check WordPress plugin changelogs, Grav release notes, Wazuh security advisories, and OpenClaw patch notices.

Keep reading