Security Digest: September 6, 2026 - 17 Critical Vulnerabilities

Today’s alerts are dominated by internet-facing router flaws, WordPress account-takeover bugs, and a cluster of publicly exploitable SQL injection issues. Several of these have public exploits already available, which means attackers can move fast; patching, disabling exposed services, and checking for compromise should happen now.

2026-09-06 · 13 min read

Urgent Security Digest: September 6, 2026

Executive Summary

Today’s alerts are dominated by internet-facing router flaws, WordPress account-takeover bugs, and a cluster of publicly exploitable SQL injection issues. Several of these have public exploits already available, which means attackers can move fast; patching, disabling exposed services, and checking for compromise should happen now.

If you run Tenda HG10 or CP3, WordPress with MemberDash, Frontend Admin, or HivePress Authentication, or any of the affected SourceCodester/code-projects applications, treat these as active-risk findings and prioritize emergency remediation.

Critical Vulnerabilities

CVE-2026-86167: Tenda HG10 command injection in formgponConf

Impact: Remote attackers can run operating-system commands on the device. Public exploit code is available.
Affected Systems: Tenda HG10 300001138, Boa component, /boaform/admin/formgponConf
Immediate Action: Remove the device from direct internet exposure, disable remote administration, and replace or isolate the unit until a vendor fix is confirmed.
Mitigation: Apply the vendor patch immediately if available; otherwise block WAN access to the admin interface and monitor for unusual outbound traffic or reboot events.

CVE-2026-16310: MemberDash IDOR enables WordPress account takeover

Impact: Unauthenticated attackers can change any user password, including administrator accounts.
Affected Systems: MemberDash plugin for WordPress versions up to and including 1.8.5
Immediate Action: Disable the plugin or take the site offline for maintenance until patched.
Mitigation: Update to a fixed version as soon as it is released; review admin accounts, reset credentials, and check for unauthorized registration or password-reset activity.

CVE-2026-75816: Frontend Admin authentication bypass to account takeover

Impact: Attackers can overwrite user email addresses and then take over accounts through password reset.
Affected Systems: Frontend Admin by DynamiApps up to and including 3.29.12
Immediate Action: Suspend public-facing form submissions or disable the plugin until patched.
Mitigation: Upgrade immediately, then audit user profiles and reset any accounts with changed email addresses or suspicious resets.

CVE-2026-86165: Tenda HG10 buffer overflow in formURL

Impact: Remote attackers may crash the device or potentially execute code. Public exploit code is available.
Affected Systems: Tenda HG10 300001138, Boa component, /boaform/admin/formURL
Immediate Action: Block external access to the management interface and replace exposed devices where possible.
Mitigation: Install the vendor update when available; if not, place the device behind a trusted admin network and monitor for instability.

CVE-2026-86151: Tenda CP3 command injection in network configuration management

Impact: Remote command execution on affected devices.
Affected Systems: Tenda CP3 27.5.57.101, Apis/system.c
Immediate Action: Remove WAN exposure and restrict management access immediately.
Mitigation: Patch or replace the device; review logs and network telemetry for suspicious configuration changes.

CVE-2026-86153: Tenda CP3 improper privilege management

Impact: Attackers may gain unauthorized higher privileges remotely.
Affected Systems: Tenda CP3 27.5.57.101, Functions/Redirect.cpp
Immediate Action: Lock down administrative access and review all privileged accounts and settings.
Mitigation: Apply vendor remediation; if unavailable, isolate the device and verify no unauthorized redirect or policy changes.

CVE-2026-86166: Tenda HG10 buffer overflow in formWanRedirect

Impact: Remote attackers may trigger a crash or code execution. Public exploit code is available.
Affected Systems: Tenda HG10 300001138, Boa Web Server, /boaform/formWanRedirect
Immediate Action: Disable remote administration and block the affected service from untrusted networks.
Mitigation: Patch as soon as possible; otherwise isolate the device and monitor for repeated reboot or service failure events.

CVE-2026-18056: HivePress Authentication token trust flaw

Impact: Attackers with a valid victim access token can log in as that user, including admins.
Affected Systems: HivePress Authentication plugin up to and including 1.1.4
Immediate Action: Disable Facebook login or the plugin until a fix is deployed.
Mitigation: Upgrade immediately; rotate credentials for any impacted accounts and review login history for suspicious social-auth activity.

CVE-2026-86161: SourceCodester Online Voting System SQL injection in delete_category

Impact: Remote attackers may dump, modify, or delete database data; the exploit is public.
Affected Systems: SourceCodester Online Voting System 1.0, /ajax.php?action=delete_category
Immediate Action: Take the application offline or restrict it to trusted networks only.
Mitigation: Patch the application, validate all inputs, and rotate database credentials after remediation.

CVE-2026-86208: Class and Exam Timetabling System SQL injection in delete_teacher

Impact: Database compromise and possible full application takeover.
Affected Systems: SourceCodester Class and Exam Timetabling System 1.0, /delete_teacher.php
Immediate Action: Remove public access until patched.
Mitigation: Apply the vendor fix, rotate credentials, and inspect for unauthorized record changes.

CVE-2026-86209: Class and Exam Timetabling System SQL injection in delete_user

Impact: Remote attackers can manipulate the database and potentially escalate access.
Affected Systems: SourceCodester Class and Exam Timetabling System 1.0, /delete_user.php
Immediate Action: Disable the endpoint or isolate the system.
Mitigation: Patch immediately and audit user tables and admin sessions.

CVE-2026-86210: Class and Exam Timetabling System SQL injection in delete_user_account

Impact: Attackers may delete or alter user-account data remotely.
Affected Systems: SourceCodester Class and Exam Timetabling System 1.0, /delete_user_account.php
Immediate Action: Block external access and verify backups before changing anything.
Mitigation: Patch, then review application logs for injected parameters and unexpected account deletions.

CVE-2026-86162: SourceCodester Online Voting System SQL injection in login

Impact: Remote attackers can bypass or manipulate authentication logic.
Affected Systems: SourceCodester Online Voting System 1.0, /ajax.php?action=login
Immediate Action: Disable the login endpoint or take the app offline until fixed.
Mitigation: Patch immediately, reset user passwords, and review authentication logs for anomalies.

CVE-2026-86180: Task Management System SQL injection in login email field

Impact: Attackers may inject SQL through the login form and compromise accounts or data.
Affected Systems: code-projects Task Management System In PHP 1.0, /index.php
Immediate Action: Restrict access to the login page and monitor for exploitation attempts.
Mitigation: Apply the fix, enforce parameterized queries, and rotate credentials if the app was exposed.

CVE-2026-86160: SourceCodester Online Voting System SQL injection in delete_voting

Impact: Remote attackers can alter or delete voting records.
Affected Systems: SourceCodester Online Voting System 1.0, /ajax.php?action=delete_voting
Immediate Action: Take the application offline or block the vulnerable route.
Mitigation: Patch the code and audit database integrity after remediation.

CVE-2026-86159: SourceCodester Online Voting System SQL injection in save_user

Impact: Attackers may create or modify users and potentially gain elevated access.
Affected Systems: SourceCodester Online Voting System 1.0, /ajax.php?action=save_user
Immediate Action: Restrict access and review all newly created or changed users.
Mitigation: Patch immediately and rotate application and database credentials.

CVE-2026-86168: code-projects Content Management System SQL injection in login

Impact: Remote attackers can exploit the login form to manipulate the backend database.
Affected Systems: code-projects Content Management System 1.0, /login.php
Immediate Action: Remove public exposure and treat the system as high risk until patched.
Mitigation: Apply the vendor fix, review authentication logs, and reset credentials if compromise is suspected.

Previously Alerted

CVE-2026-86152 Security Alert: CRITICAL Vulnerability

What to Do Now

Patch or disable exposed systems today — prioritize Tenda HG10, Tenda CP3, and the affected WordPress plugins.
Remove internet exposure from admin panels, login pages, and vulnerable AJAX endpoints.
Rotate credentials for WordPress admins, database users, and any accounts tied to affected apps.
Check for compromise by reviewing login history, account changes, redirects, unexpected reboots, and database edits.
Deploy compensating controls such as IP allowlisting, web application firewall rules, and temporary service shutdowns.

Verification steps: confirm versions against the affected ranges, verify patches are applied, and test that vulnerable endpoints are no longer reachable from the public internet.

Monitoring recommendations: alert on failed logins, password resets, new admin creation, outbound connections from routers, and unusual SQL error patterns or parameter values.

Related Resources

Internal blog post: WordPress account-takeover checklist for plugin emergencies (to be published)
Internal blog post: How to quarantine exposed SOHO routers in 30 minutes (to be published)
Official vendor advisories: check the Tenda, WordPress plugin, and application maintainer security advisories for fixed releases and mitigation notes.