Security Digest: October 8, 2026 - 8 Critical Vulnerabilities

Today’s risk is immediate and broad: multiple critical flaws allow unauthenticated remote code execution, arbitrary file upload, and destructive file deletion across WordPress plugins, network appliances, and enterprise tools. If you run any affected product, treat this as an urgent patch-and-contain event today.

· 8 min read

Executive Summary

Today’s risk is immediate and broad: multiple critical flaws allow unauthenticated remote code execution, arbitrary file upload, and destructive file deletion across WordPress plugins, network appliances, and enterprise tools. If you run any affected product, treat this as an urgent patch-and-contain event today.

Priority one is to patch exposed internet-facing systems first, then verify whether any suspicious uploads, command execution, or unexpected deletions have already occurred. Where fixes are not yet available, disable the affected feature or isolate the service now.

Critical Vulnerabilities

CVE-2026-85097: Bricksforge WordPress plugin arbitrary file upload leading to code execution

  • Impact: Unauthenticated attackers can upload and execute arbitrary PHP code on the server.
  • Affected Systems: Bricksforge plugin for WordPress versions up to and including 3.1.8.9.
  • Immediate Action: Disable Bricksforge on exposed sites, restrict access to WordPress admin and AJAX endpoints, and check for unexpected PHP files in upload and temp directories.
  • Mitigation: Apply the vendor fix as soon as available; if you cannot patch immediately, remove the plugin and block access to bricksforge_regenerate_nonce and form submission endpoints.

CVE-2026-107459: SecuShare Pro OS command injection

  • Impact: Unauthenticated attackers can run arbitrary OS commands on the server.
  • Affected Systems: Openfind SecuShare Pro installations.
  • Immediate Action: Isolate the system from the internet, review logs for suspicious shell activity, and assume compromise if the product is publicly reachable.
  • Mitigation: Patch immediately from the vendor advisory; until then, place the service behind VPN or strict allowlisting.

CVE-2026-105110: Iskratel Innbox GPON ONT command injection in login.xgi

  • Impact: Unauthenticated remote attackers can execute commands as root.
  • Affected Systems: Iskratel Innbox GPON ONT devices exposed to network access.
  • Immediate Action: Remove WAN exposure, restrict management access, and inspect for unauthorized configuration changes or reboot events.
  • Mitigation: Install the vendor firmware update; if unavailable, disable remote management and segment the device immediately.

CVE-2026-107510: Troubleshooting command argument injection leading to privilege escalation

  • Impact: An authenticated high-privilege user can escalate privileges by injecting arguments into troubleshooting commands.
  • Affected Systems: Systems exposing the affected troubleshooting workflow.
  • Immediate Action: Limit high-privilege accounts, review recent admin actions, and disable troubleshooting access for non-essential users.
  • Mitigation: Apply the vendor patch and enforce least privilege for all administrative roles.

CVE-2026-17609: Super Forms arbitrary directory deletion

  • Impact: Unauthenticated attackers can recursively delete arbitrary directories, including the WordPress root, if the file-deletion feature is enabled.
  • Affected Systems: Super Forms – Drag & Drop Form Builder for WordPress versions up to and including 6.3.316.
  • Immediate Action: Turn off “Delete files from server after form submissions” now, back up the site, and inspect file and directory integrity.
  • Mitigation: Update to a fixed version when released; if you cannot patch, disable the plugin or the deletion feature immediately.

CVE-2026-17196: Super Forms unrestricted file upload

  • Impact: Authenticated attackers with low-privilege access can upload executable files and potentially gain remote code execution.
  • Affected Systems: Super Forms – Drag & Drop Form Builder for WordPress versions up to and including 6.3.316.
  • Immediate Action: Restrict subscriber-level accounts, audit recent uploads, and look for unexpected changes to _super_elements metadata.
  • Mitigation: Patch immediately; until then, disable file upload forms and review any AJAX endpoints that allow form metadata updates.

CVE-2026-107450: Stump smart list takeover via GraphQL

  • Impact: Any authenticated user with the shared permission can overwrite, delete, or take over another user’s smart list.
  • Affected Systems: Stump through 0.1.10.
  • Immediate Action: Review GraphQL access controls, disable untrusted authenticated users if possible, and check for altered list ownership or visibility changes.
  • Mitigation: Upgrade to a fixed release; add server-side ownership checks and tighten GraphQL permissions.

CVE-2026-89322: Vault ACL canonicalization bypass

  • Impact: Authenticated users with delegated permissions may bypass explicit denies and access protected resources or assign denied policies, potentially escalating privileges.
  • Affected Systems: HashiCorp Vault and Vault Enterprise versions fixed in 2.1.2 (Community and Enterprise), 1.21.12, 1.20.17, and 1.19.23.
  • Immediate Action: Prioritize Vault patching, review delegated policy assignments, and look for unexpected access grants or policy changes.
  • Mitigation: Upgrade to the fixed release for your branch and revalidate ACL behavior after patching.

What to Do Now

  1. Patch or isolate exposed systems first. Internet-facing WordPress sites, appliances, and Vault instances are highest priority.
  2. Disable risky features immediately. Turn off file deletion, file upload, remote management, and unnecessary admin or troubleshooting functions.
  3. Check for compromise. Hunt for new PHP files, unexpected command execution, altered configs, deleted directories, and unauthorized policy or ownership changes.

Verification steps:

  • Confirm exact product versions against the vulnerable ranges above.
  • Review logs for suspicious AJAX requests, GraphQL mutations, CGI calls, and upload activity.
  • Validate file integrity and compare backups for missing or modified directories.

Monitoring recommendations:

  • Alert on new web shells, unusual child processes, and outbound connections from web servers and appliances.
  • Watch for admin account changes, policy edits, and unexpected privilege escalation in Vault and application consoles.
  • Increase scrutiny on WordPress plugins with upload, form, or file-management features.

Related Resources

  • Internal blog posts: Add internal incident notes and patch guidance for WordPress plugins, Vault, and edge appliances.
  • Official vendor advisories: Bricksforge, Openfind SecuShare Pro, Iskratel, Super Forms, Stump project maintainers, and HashiCorp Vault security advisories.

Keep reading