Security Digest: September 1, 2026 - 11 Critical Vulnerabilities

Today’s security picture is urgent: multiple critical command-injection flaws are publicly disclosed and remotely exploitable, including several in network and satellite devices with no vendor response and at least one product line already abandoned. WordPress ecosystems are also carrying high-risk bugs that can lead to remote code execution, file deletion, authentication bypass, and persistent cross-site scripting.

· 9 min read

Today’s Threats: Exploits in the Wild, Remote Takeover Risks, and Unsupported Devices at Immediate Risk

Executive Summary

Today’s security picture is urgent: multiple critical command-injection flaws are publicly disclosed and remotely exploitable, including several in network and satellite devices with no vendor response and at least one product line already abandoned. WordPress ecosystems are also carrying high-risk bugs that can lead to remote code execution, file deletion, authentication bypass, and persistent cross-site scripting.

Action now: patch exposed systems immediately, disable or isolate vulnerable products that cannot be updated, and hunt for signs of webshells, new admin accounts, suspicious uploads, and unexpected outbound activity.

Critical Vulnerabilities

CVE-2026-82971: QVidium Opera11 CGI command injection

  • Impact: Remote attackers can inject commands through the ipaddr parameter and potentially take over affected devices.
  • Affected Systems: QVidium Opera11 3.3.2a26-Ax4x-opera11; unsupported product line.
  • Immediate Action: Disconnect or isolate the device now. If it is internet-facing, remove exposure immediately and review for compromise.
  • Mitigation: There is no vendor support or patch path. Replace the device, segment it, and block access to /cgi-bin/net_tr.cgi.

CVE-2026-83524: RedPort Optimizer system clock command injection

  • Impact: Remote command execution via the System Clock component.
  • Affected Systems: RedPort Optimizer wXa-203, wXa-213, wXa-223 up to 20260704.
  • Immediate Action: Remove from public access and treat as compromised if exposed to the internet.
  • Mitigation: Apply vendor remediation if released; otherwise isolate, restrict admin access, and plan replacement.

CVE-2026-83772: Cobham SATCOM VSAT7090 mail-report.sh command injection

  • Impact: Remote attackers can inject commands through mail report processing.
  • Affected Systems: Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704.
  • Immediate Action: Restrict network access immediately and inspect for suspicious mail-report activity.
  • Mitigation: Apply updates if available; otherwise isolate the router and disable exposed reporting features.

CVE-2026-75865: WPLP Cookie Consent arbitrary file upload

  • Impact: Unauthenticated attackers can upload arbitrary files, creating a path to remote code execution.
  • Affected Systems: WPLP Cookie Consent plugin up to and including 4.4.1.
  • Immediate Action: Update or disable the plugin now; review uploads and webroot for unexpected files.
  • Mitigation: Patch immediately, remove unknown uploads, and restrict PHP execution in upload directories.

CVE-2026-19806: Support Genix authentication bypass to admin takeover

  • Impact: Attackers with low-privilege access can forge tokens and gain full administrator access.
  • Affected Systems: Support Genix plugin up to and including 1.4.52.
  • Immediate Action: Disable the plugin or restrict access until patched; rotate admin credentials if exposed.
  • Mitigation: Apply the vendor fix, invalidate existing tokens, and review admin logins and ticket activity.

CVE-2026-59680: yast2-users root command injection

  • Impact: Viewing a user’s password settings can trigger root-level command execution.
  • Affected Systems: yast2-users through 5.0.8.
  • Immediate Action: Avoid opening the Password Settings tab for LDAP/federated users until patched.
  • Mitigation: Update yast2-users, and limit admin access to affected systems.

CVE-2026-19952: Frontend Admin arbitrary file deletion

  • Impact: Unauthenticated attackers can delete arbitrary files, potentially leading to site takeover.
  • Affected Systems: Frontend Admin up to and including 3.29.12.
  • Immediate Action: Update immediately and check for missing core files such as wp-config.php.
  • Mitigation: Patch, disable public forms if needed, and monitor for file integrity changes.

CVE-2026-19796: Listdom stored XSS in listing display options

  • Impact: Attackers can store scripts that run in users’ browsers, enabling session theft or admin actions.
  • Affected Systems: Listdom plugin up to and including 5.8.1 with Pro add-on and Display Options Per Listing enabled.
  • Immediate Action: Update and review listing pages for injected scripts.
  • Mitigation: Patch, disable the affected feature if possible, and clear cached pages.

CVE-2026-75921: Master Addons template kit upload leading to RCE

  • Impact: Authenticated editors can upload malicious files that may execute on the server.
  • Affected Systems: Master Addons for Elementor up to and including 3.1.9.
  • Immediate Action: Remove or update the plugin and review recent template-kit uploads.
  • Mitigation: Patch, limit editor permissions, and scan extracted ZIP contents for executable files.

CVE-2026-19573: Affiliate Super Assistent stored XSS

  • Impact: Unauthenticated attackers can inject scripts into pages viewed by others.
  • Affected Systems: Affiliate Super Assistent up to and including 1.10.2.
  • Immediate Action: Update immediately and inspect affected pages for injected content.
  • Mitigation: Patch, purge caches, and review any admin sessions that viewed compromised pages.

CVE-2026-19914: Welcart e-Commerce guest checkout XSS

  • Impact: Guest checkout input can plant scripts that execute when admins view orders.
  • Affected Systems: Welcart e-Commerce up to and including 2.12.1.
  • Immediate Action: Update now and review recent guest orders for malicious payloads.
  • Mitigation: Patch, sanitize order metadata, and monitor administrator browsers and sessions.

What to Do Now

  1. Patch or remove exposed products first: WordPress plugins, then internet-facing appliances and routers.
  2. Isolate unsupported or unpatched devices: especially QVidium and any RedPort/Cobham systems still exposed to the internet.
  3. Check for compromise: new admin users, unexpected uploads, missing files, suspicious outbound connections, and webshells.
  4. Rotate credentials and invalidate sessions for WordPress admins and any systems touched by these flaws.

Verification steps: confirm plugin versions, review exposed endpoints, and compare file integrity against known-good baselines. For appliances, verify they are no longer reachable from untrusted networks.

Monitoring recommendations: alert on writes to webroot, PHP files in upload paths, new admin logins, unusual CGI requests, and command execution from web processes. Watch for repeated hits to /cgi-bin/net_tr.cgi, /xgatev1/system/datetime.php, and mail-report.sh.

Related Resources

  • Internal: See upcoming internal blog posts on WordPress plugin triage, appliance isolation, and webshell detection.
  • Official vendor advisories: Monitor vendor security notices for QVidium, RedPort, Cobham SATCOM, WordPress plugin maintainers, and SUSE for yast2-users updates.

Keep reading