Security Digest: September 2, 2026 - 22 Critical Vulnerabilities

Twenty-two critical vulnerabilities are now public across WordPress plugins, AVideo, ManageEngine, Coolify, BookStack, Libreswan, and several other widely deployed products. The highest-risk issues include unauthenticated file deletion, password-reset bypasses, privilege escalation, SQL injection, and multiple XSS paths that can lead to account takeover or server compromise.

· 15 min read

Executive Summary

Twenty-two critical vulnerabilities are now public across WordPress plugins, AVideo, ManageEngine, Coolify, BookStack, Libreswan, and several other widely deployed products. The highest-risk issues include unauthenticated file deletion, password-reset bypasses, privilege escalation, SQL injection, and multiple XSS paths that can lead to account takeover or server compromise.

Act now: patch exposed systems first, disable vulnerable plugins and features where possible, and review logs for suspicious admin actions, password resets, and unusual file operations. If you cannot patch immediately, isolate the affected service and restrict access to trusted networks only.

Critical Vulnerabilities

  • CVE-2026-78657: SigmaForms Pro arbitrary file deletion
    • Impact: Unauthenticated attackers can delete arbitrary files, potentially leading to remote code execution if a sensitive file such as wp-config.php is removed.
    • Affected Systems: SigmaForms Pro – AI Generated Forms for WordPress, versions up to and including 1.4.11.
    • Immediate Action: Remove or disable the plugin immediately until a fixed release is installed.
    • Mitigation: Upgrade to the vendor patch as soon as available; restrict WordPress admin access and review file-deletion activity.
  • CVE-2026-84480: AVideo expired password reset tokens
    • Impact: Attackers with a reset token can reuse it indefinitely to take over accounts.
    • Affected Systems: WWBN AVideo installations with vulnerable userRecoverPassSave.json.php handling.
    • Immediate Action: Force password resets for exposed accounts and invalidate all recovery tokens.
    • Mitigation: Apply the vendor fix; monitor for repeated recovery attempts and unexpected password changes.
  • CVE-2026-9055: Amelia Premium privilege escalation
    • Impact: Unauthenticated attackers can escalate to administrator by abusing the customer update flow.
    • Affected Systems: Amelia Premium WordPress plugin versions 8.0 through 9.6.2.
    • Immediate Action: Disable public-facing booking endpoints if possible and patch immediately.
    • Mitigation: Upgrade to a fixed version; review user roles and remove any unexpected manager/admin accounts.
  • CVE-2026-84479: AVideo User-Agent trust bypass
    • Impact: Attackers can bypass 2FA, brute-force protections, and login audit controls by spoofing User-Agent: AVideoEncoder.
    • Affected Systems: WWBN AVideo current e01e41ecc and earlier.
    • Immediate Action: Restrict access to login endpoints and treat any login from the encoder/mobile app as untrusted until patched.
    • Mitigation: No patch was available at publication; compensate with network controls, MFA review, and alerting on suspicious logins.
  • CVE-2026-84699: Team Password Manager local password reset bypass
    • Impact: Unauthenticated attackers can reset local account passwords and log in as those users.
    • Affected Systems: Team Password Manager before 14.184.308.
    • Immediate Action: Upgrade immediately and rotate credentials for any exposed local accounts.
    • Mitigation: Block public access to the reset flow until patched; audit recent account changes.
  • CVE-2026-84482: AVideo CSRF on administrative writes
    • Impact: Attackers can trick logged-in admins into making live configuration changes.
    • Affected Systems: WWBN AVideo through commit 9c39d8c8.
    • Immediate Action: Limit admin access and log out all admin sessions if suspicious activity is suspected.
    • Mitigation: Apply the vendor fix; enforce strong CSRF protections and same-site cookie settings.
  • CVE-2026-14357: DevKit Pro theme install abuse
    • Impact: Authenticated attackers with Subscriber-level access can install malicious theme ZIPs containing PHP.
    • Affected Systems: DevKit Pro WordPress plugin up to and including 2.3.0.
    • Immediate Action: Remove subscriber access where possible and disable the plugin until patched.
    • Mitigation: Upgrade immediately; inspect wp-content/themes/ for unexpected files.
  • CVE-2026-14828: ManageEngine authenticated SQL injection
    • Impact: Attackers with authentication can extract or alter sensitive database data.
    • Affected Systems: Password Manager Pro before 13235, PAM360 before 8561, Access Manager Plus before 4405.
    • Immediate Action: Patch all three products now and review privileged database access.
    • Mitigation: Restrict admin logins, rotate secrets if exposure is suspected, and monitor for unusual query patterns.
  • CVE-2026-84694: Coolify command injection via environment keys
    • Impact: Authenticated attackers can run arbitrary commands on managed hosts outside containers.
    • Affected Systems: Coolify before 4.2.0.
    • Immediate Action: Stop untrusted users from editing environment variables and patch immediately.
    • Mitigation: Upgrade, then review SSH command history and host-level processes for signs of abuse.
  • CVE-2026-84695: BookStack stored XSS in drawing uploads
    • Impact: Attackers can execute scripts in administrator browsers and steal sessions or perform actions as admins.
    • Affected Systems: BookStack before 26.05.4.
    • Immediate Action: Disable drawing uploads or restrict editor permissions until patched.
    • Mitigation: Upgrade immediately; verify no malicious SVG content has been stored.
  • CVE-2024-35585: MinKNOW IP-based authentication flaw
    • Impact: Authentication can be bypassed if source IP is trusted incorrectly.
    • Affected Systems: Oxford Nanopore MinKNOW before 24.06.
    • Immediate Action: Restrict network access to the application and remove any reliance on source IP for trust decisions.
    • Mitigation: Upgrade to the fixed release and place the service behind strong authentication controls.
  • CVE-2026-84696: Phison PS3111-S11 firmware command access
    • Impact: Attackers can read/write controller memory and raw flash, enabling persistent implants.
    • Affected Systems: Phison PS3111-S11 firmware through SBFQT1.3.
    • Immediate Action: Identify affected hardware and remove it from sensitive environments where possible.
    • Mitigation: Apply vendor firmware updates; treat exposed devices as high-risk until remediated.
  • CVE-2026-14982: WP File Download arbitrary file deletion
    • Impact: Authenticated attackers can delete arbitrary files and potentially trigger remote code execution.
    • Affected Systems: WP File Download plugin in all versions described.
    • Immediate Action: Disable the plugin or block subscriber-level access immediately.
    • Mitigation: Patch as soon as available; check for tampered metadata and deleted core files.
  • CVE-2026-84702: facefusion path traversal file write
    • Impact: Attackers can write files outside the jobs directory through the unauthenticated API.
    • Affected Systems: facefusion through 3.6.1.
    • Immediate Action: Restrict API exposure to trusted networks only.
    • Mitigation: Upgrade immediately and scan for unexpected files in web-accessible or startup paths.
  • CVE-2026-84208: AVideo unauthenticated SQL injection
    • Impact: Attackers can read arbitrary database contents, including password hashes and sensitive records.
    • Affected Systems: AVideo through version 29.0, User_Location plugin endpoints.
    • Immediate Action: Patch now and block public access to the affected endpoints.
    • Mitigation: Review database logs and rotate credentials if exposure is suspected.
  • CVE-2026-84476: AVideo rate-limit bypass via spoofed IP headers
    • Impact: Attackers can bypass login throttling and perform unlimited credential guessing.
    • Affected Systems: WWBN AVideo installations trusting X-Real-IP or X-Forwarded-For without trusted proxy validation.
    • Immediate Action: Remove header trust unless traffic comes from known proxies only.
    • Mitigation: Patch and enforce proxy allowlists; monitor for repeated login attempts from rotating IPs.
  • CVE-2026-14957: Libreswan FIPS-mode crash
    • Impact: Remote attackers can crash the pluto daemon repeatedly, causing denial of service.
    • Affected Systems: Libreswan in FIPS mode with CA certificates loaded; both IKEv1 and IKEv2.
    • Immediate Action: If you are in FIPS mode, prioritize patching and monitor VPN availability closely.
    • Mitigation: Upgrade immediately; PSK-only deployments without CA certs are not affected.
  • CVE-2026-84485: APITable unauthenticated directory exposure
    • Impact: Attackers can enumerate member names, email addresses, and team hierarchy.
    • Affected Systems: APITable through 1.13.0-beta.1.
    • Immediate Action: Restrict public workspace links and block access to the organization endpoint.
    • Mitigation: Patch immediately and review for data exposure in shared spaces.
  • CVE-2026-84423: Casdoor upload-resource authentication bypass
    • Impact: Remote attackers can abuse the upload-resource API without authentication.
    • Affected Systems: Casdoor up to 4.0.0.
    • Immediate Action: Remove internet exposure until the vendor fix is applied.
    • Mitigation: Upgrade now; treat the issue as actively exploitable because public disclosure is already available.
  • CVE-2026-84478: AVideo log deletion via path traversal
    • Impact: Unauthenticated attackers can delete .log files and erase evidence of intrusion.
    • Affected Systems: WWBN AVideo get_api_login_code endpoint.
    • Immediate Action: Preserve logs off-host and restrict access to the endpoint immediately.
    • Mitigation: Patch quickly; verify logging integrity and search for traversal attempts.
  • CVE-2026-75528: Broken Link Checker stored XSS
    • Impact: Attackers can run scripts in user browsers after the plugin's recheck workflow stores a malicious redirect.
    • Affected Systems: Broken Link Checker up to and including 2.4.13.
    • Immediate Action: Disable the plugin or suspend the recheck workflow until patched.
    • Mitigation: Upgrade immediately and review link logs for injected payloads.
  • CVE-2026-82883: Login With Ajax reflected XSS
    • Impact: Attackers can inject scripts into login-related pages and steal sessions or credentials.
    • Affected Systems: Login With Ajax through 4.5.1.
    • Immediate Action: Patch now and sanitize any public login parameters.
    • Mitigation: Add CSP where possible and monitor for suspicious login-page traffic.

What to Do Now

  1. Patch or disable the highest-risk internet-facing services first: WordPress plugins, AVideo, ManageEngine, Coolify, Casdoor, and BookStack.
  2. Invalidate sessions and reset credentials for any system exposed to password reset, privilege escalation, or admin-bypass flaws.
  3. Restrict access immediately to admin panels, recovery endpoints, upload features, and unauthenticated APIs.
  4. Review logs for signs of abuse: unexpected role changes, password resets, file deletions, traversal strings, SQLi probes, and repeated login attempts.
  5. Confirm versions and exposure: inventory all affected products and verify whether they are reachable from the internet.

Verification steps: check installed versions against the affected ranges, confirm all vendor patches are applied, and validate that no unexpected theme, log, or job files were created. For AVideo, inspect authentication and rate-limit behavior; for WordPress sites, audit plugin lists and administrator accounts.

Monitoring recommendations: alert on admin role changes, new users, password reset events, file deletions in web roots, suspicious User-Agent values, and requests containing traversal or SQL injection patterns. Preserve logs off-host to prevent tampering.

Related Resources

  • Internal: See the upcoming internal blog post on emergency patch prioritization for exposed web apps.
  • Internal: See the upcoming internal blog post on detecting plugin abuse and account takeover attempts.
  • Official vendor advisories: Track release notes and security bulletins from WWBN, WordPress plugin vendors, Zohocorp, Coolify, BookStack, Libreswan, Casdoor, and Team Password Manager.

Keep reading