Security Digest: September 5, 2026 - 25 Critical Vulnerabilities

Today’s alert is dominated by remote code execution, authentication bypass, SQL injection, and widespread WordPress plugin exposure. Several issues are already exploitable with no authentication, and multiple WordPress plugins can be abused from the public internet if left unpatched.

· 15 min read

Security Digest: September 5, 2026 — 25 Critical Vulnerabilities

Executive Summary

Today’s alert is dominated by remote code execution, authentication bypass, SQL injection, and widespread WordPress plugin exposure. Several issues are already exploitable with no authentication, and multiple WordPress plugins can be abused from the public internet if left unpatched.

Act now: patch exposed systems first, disable risky features where needed, and verify that no vulnerable plugin or service remains internet-facing. If you run WordPress, wiki platforms, or AI/dev tooling in containers, treat this as a same-day remediation event.

Critical Vulnerabilities

  • CVE-2024-11080: ComboBlocks unauthenticated hook injection
    • Impact: Unauthenticated attackers can trigger WordPress hook actions and potentially chain to broader compromise.
    • Affected Systems: Post Grid and Gutenberg Blocks – ComboBlocks 2.2.32 through 2.3.1.
    • Immediate Action: Remove or disable the plugin on exposed sites until patched.
    • Mitigation: Upgrade to a fixed release as soon as available; review WordPress logs for unexpected hook activity.
  • CVE-2026-83627: Hummingbird page-cache log RCE
    • Impact: Unauthenticated attackers may write PHP into a web-accessible log file and execute code remotely.
    • Affected Systems: Hummingbird plugin up to and including 3.21.0, when Page Caching Debug Log is enabled.
    • Immediate Action: Disable Page Caching Debug Log now and inspect wp-content/wphb-logs/.
    • Mitigation: Upgrade immediately; delete exposed log files and confirm they are not web-accessible.
  • CVE-2026-86121: Cua computer-server auth bypass to command execution
    • Impact: Attackers can run shell commands, read/write files, and open PTY shells without authentication.
    • Affected Systems: Cua computer-server before 0.3.42, especially when CONTAINER_NAME is unset.
    • Immediate Action: Isolate port 8000 from the network immediately.
    • Mitigation: Upgrade to 0.3.42 or later; enforce authentication and restrict binding to localhost.
  • CVE-2026-86124: AutoAgent unauthenticated root RCE
    • Impact: Remote attackers can execute arbitrary bash commands as root inside the container.
    • Affected Systems: AutoAgent deployments exposing the TCP server.
    • Immediate Action: Shut down external access to the TCP port now.
    • Mitigation: Patch immediately; redeploy with network restrictions and least-privilege container settings.
  • CVE-2026-52766: YesWiki unauthorized page deletion
    • Impact: Authenticated users with basic write access can delete arbitrary wiki pages, including admin and front pages.
    • Affected Systems: YesWiki before 4.6.6.
    • Immediate Action: Restrict write access and monitor for mass deletions.
    • Mitigation: Upgrade to 4.6.6; review ACLs and restore from backups if needed.
  • CVE-2026-48019: Laravel email validation CRLF injection
    • Impact: Attackers may disrupt outbound email processing and interfere with mail flows.
    • Affected Systems: Laravel before 12.60.0 and 13.10.0.
    • Immediate Action: Patch application frameworks and inspect mail-sending workflows.
    • Mitigation: Upgrade to 12.60.0 or 13.10.0; validate user-supplied email handling.
  • CVE-2026-52775: YesWiki SQL injection in reaction deletion
    • Impact: Authenticated users can inject SQL and potentially extract or alter data.
    • Affected Systems: YesWiki before 4.6.6.
    • Immediate Action: Limit authenticated write access until patched.
    • Mitigation: Upgrade to 4.6.6; review database logs for abnormal queries.
  • CVE-2026-19887: Welcart PHP object injection
    • Impact: Attackers may delete critical files and potentially reach full RCE through installer abuse.
    • Affected Systems: Welcart e-Commerce up to and including 2.12.1.
    • Immediate Action: Disable the affected payment callback path if possible.
    • Mitigation: Upgrade immediately; inspect for file deletion attempts and backup integrity.
  • CVE-2026-81543: Abandoned Cart Pro privilege escalation
    • Impact: Subscriber-level users can hijack admin recovery flows and gain full admin access.
    • Affected Systems: Abandoned Cart Pro for WooCommerce up to and including 10.7.1.
    • Immediate Action: Disable auto-login and review connector settings.
    • Mitigation: Patch immediately; rotate SMTP credentials and audit admin sessions.
  • CVE-2026-86123: SQL Chat unauthenticated SQL execution
    • Impact: Attackers can run arbitrary SQL against attacker-chosen hosts and pivot into internal networks.
    • Affected Systems: SQL Chat deployments exposing the vulnerable API endpoints.
    • Immediate Action: Block public access to the API now.
    • Mitigation: Patch or remove the service; restrict outbound network access.
  • CVE-2026-86119: Webstudio SSRF via proxy routes
    • Impact: Attackers can reach internal services and cloud metadata endpoints.
    • Affected Systems: Webstudio through 0.296.0 when RESIZE_ORIGIN is unset.
    • Immediate Action: Set the required environment variable or disable the proxy routes.
    • Mitigation: Upgrade and enforce egress filtering to block metadata access.
  • CVE-2026-52771: YesWiki SQL injection in page deletion
    • Impact: Low-privilege users can execute arbitrary SQL through crafted page tags.
    • Affected Systems: YesWiki 4.2.0 through before 4.6.6.
    • Immediate Action: Restrict API write access and watch for suspicious page tags.
    • Mitigation: Upgrade to 4.6.6; review database for tampering.
  • CVE-2026-52769: YesWiki SSRF via ActivityPub inbox
    • Impact: Unauthenticated attackers can force the server to make requests to internal or cloud targets.
    • Affected Systems: YesWiki 4.6.2 through before 4.6.6 with ActivityPub enabled.
    • Immediate Action: Disable ActivityPub on exposed forms until patched.
    • Mitigation: Upgrade to 4.6.6; block access to metadata and internal ranges.
  • CVE-2026-86145: PCRE2 out-of-bounds write
    • Impact: Crafted regex input may crash services or enable memory corruption.
    • Affected Systems: PCRE2 before 10.48.
    • Immediate Action: Identify applications bundling old PCRE2 builds.
    • Mitigation: Upgrade PCRE2 to 10.48 or later; limit attacker-controlled regex usage.
  • CVE-2026-86117: Coolify OAuth authentication bypass
    • Impact: Attackers can sign into victim accounts using only an email address.
    • Affected Systems: Coolify through 4.3.17.
    • Immediate Action: Review OAuth providers and suspend exposed login flows if needed.
    • Mitigation: Patch immediately; force password resets and revoke active sessions.
  • CVE-2026-52770: YesWiki unauthenticated SQL injection in Bazar filters
    • Impact: Attackers can infer or extract database data through injected filters.
    • Affected Systems: YesWiki 4.2.0 through before 4.6.6.
    • Immediate Action: Restrict public API exposure.
    • Mitigation: Upgrade to 4.6.6; review logs for unusual query patterns.
  • CVE-2026-15984: QuickCal stored XSS
    • Impact: Attackers can inject scripts that run for site visitors.
    • Affected Systems: QuickCal up to and including 1.0.20.
    • Immediate Action: Disable public booking pages if you cannot patch immediately.
    • Mitigation: Upgrade; sanitize custom fields and review injected content.
  • CVE-2026-19769: Ninja Forms stored XSS via file upload path
    • Impact: Attackers can plant executable HTML/JS on the site.
    • Affected Systems: Ninja Forms up to and including 3.15.1 with File Uploads add-on active.
    • Immediate Action: Disable the add-on or file upload path until patched.
    • Mitigation: Upgrade immediately; scan web-writable directories for attacker files.
  • CVE-2026-16649: Gravity Forms stored XSS
    • Impact: Visitors may execute attacker-supplied scripts in affected pages.
    • Affected Systems: Gravity Forms up to and including 2.10.5.
    • Immediate Action: Review forms that render post body fields.
    • Mitigation: Upgrade; inspect rendered content for malicious attributes.
  • CVE-2026-18406: SureForms stored XSS
    • Impact: Attackers can inject scripts through text fields.
    • Affected Systems: SureForms up to and including 2.12.2.
    • Immediate Action: Restrict unauthenticated form submissions where possible.
    • Mitigation: Patch; validate and escape all stored form input.
  • CVE-2026-78438: W3 Total Cache stored XSS via LazyLoad background processing
    • Impact: Approved comments can trigger script execution on page load.
    • Affected Systems: W3 Total Cache up to and including 2.10.5 with Lazy Load Images background processing enabled.
    • Immediate Action: Disable the feature until fixed.
    • Mitigation: Upgrade; review approved comments with suspicious markup.
  • CVE-2026-77830: CleanTalk stored XSS in comments
    • Impact: Attackers can execute scripts for non-logged-in visitors.
    • Affected Systems: CleanTalk up to and including 6.86.
    • Immediate Action: Tighten comment moderation and review recent submissions.
    • Mitigation: Upgrade; inspect rendered comments for event-handler payloads.
  • CVE-2026-83625: Contact Form by Supsystic stored XSS via IP header
    • Impact: Attackers can inject scripts by spoofing IP headers in form submissions.
    • Affected Systems: Contact Form by Supsystic up to and including 1.10.2.
    • Immediate Action: Block or normalize spoofable proxy headers at the edge.
    • Mitigation: Upgrade; verify nonce handling and header trust settings.
  • CVE-2026-77233: iubenda stored XSS via AdSense regex rewrite
    • Impact: Attackers can run scripts in affected comment content flows.
    • Affected Systems: iubenda All-in-one Compliance up to and including 3.13.4 when the Secondary parser is active.
    • Immediate Action: Confirm parser engine settings and disable the vulnerable mode.
    • Mitigation: Upgrade; prefer the safer default parser engine.
  • CVE-2026-77263: iubenda stored XSS via comment content mutation
    • Impact: Attackers can transform inert markup into executable script in the WordPress origin.
    • Affected Systems: iubenda All-in-one Compliance up to and including 3.13.4.
    • Immediate Action: Review comment moderation and recent submissions immediately.
    • Mitigation: Upgrade; scan for suspicious attributes and mutated HTML.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first — especially WordPress plugins, wiki platforms, and exposed AI/dev services.
  2. Disable risky features immediately — debug logs, lazy-load background processing, public proxy routes, auto-login, and public write APIs.
  3. Restrict exposure — block public access to admin ports, TCP services, and APIs that should never be internet-facing.
  4. Rotate credentials if you find signs of admin takeover, SMTP tampering, or OAuth abuse.
  5. Check backups and file integrity for file deletion, webshells, unexpected PHP files, and modified comment content.

Verification: confirm plugin versions, compare deployed framework versions against fixed releases, and review access logs for anonymous requests to log files, callback endpoints, and metadata IP ranges.

Monitoring: alert on new PHP files in web-writable directories, unusual outbound HTTP requests, SQL errors, repeated login anomalies, and sudden changes to admin settings or comment-rendered HTML.

Related Resources

  • Internal blog post: Today’s high-risk CVEs: patch prioritization guide (to be published)
  • Internal blog post: WordPress plugin exposure checklist for emergency response (to be published)
  • Official vendor advisories: Laravel, YesWiki, WordPress plugin maintainers, PCRE2 project, Coolify, and affected application vendors

Keep reading