Security Digest: October 24, 2026 - 14 Critical Vulnerabilities

Today’s alert is dominated by high-risk WordPress plugin flaws, including multiple critical deserialization bugs that can lead to full site compromise, plus SQL injection and several XSS issues that can be used to steal sessions, alter content, or pivot deeper into affected environments. Teams should patch or disable exposed plugins immediately, review admin activity, and treat any site using these components as potentially at risk until verified clean.

· 11 min read

Executive Summary

Today’s alert is dominated by high-risk WordPress plugin flaws, including multiple critical deserialization bugs that can lead to full site compromise, plus SQL injection and several XSS issues that can be used to steal sessions, alter content, or pivot deeper into affected environments. Teams should patch or disable exposed plugins immediately, review admin activity, and treat any site using these components as potentially at risk until verified clean.

The most urgent items are the Paytium, Prime Mover, Newsletters Lite, and Product Filter by WBW vulnerabilities. If any affected plugin is installed, prioritize emergency updates, remove unused instances, and monitor for suspicious comments, exports, and admin actions.

Critical Vulnerabilities

CVE-2026-114196: Paytium object injection

  • Impact: Attackers may inject malicious objects through untrusted deserialization, potentially leading to code execution or full site compromise.
  • Affected Systems: Paytium versions through 5.0.5.
  • Immediate Action: Identify every WordPress site using Paytium and remove or disable it until patched.
  • Mitigation: Update to the first fixed release as soon as vendor guidance is available; if no patch is available, take the plugin offline.

CVE-2026-115806: Prime Mover backup and migration PHP object injection

  • Impact: An unauthenticated attacker can plant a crafted serialized object via comments and trigger object injection during export or restore, potentially leading to remote code execution.
  • Affected Systems: Prime Mover – Backup and Migration versions through 2.2.1.
  • Immediate Action: Disable the plugin immediately on any production site and inspect recent comment submissions and export/restore activity.
  • Mitigation: Patch to a fixed version when available; until then, block comment submission if the plugin must remain online and restrict export/restore access.

CVE-2026-94075: Newsletters Lite object injection

  • Impact: Malicious serialized input may allow object injection, with possible code execution or privilege abuse.
  • Affected Systems: Newsletters versions through 4.18.1.
  • Immediate Action: Remove the plugin from any externally reachable WordPress instance until patched.
  • Mitigation: Upgrade to the vendor-fixed version; if you cannot patch immediately, disable the plugin and review logs for unusual newsletter/admin actions.

CVE-2026-112866: Product Filter by WBW blind SQL injection

  • Impact: Attackers may extract database data, bypass controls, or weaken site security through blind SQL injection.
  • Affected Systems: Product Filter by WBW versions through 3.4.6.
  • Immediate Action: Patch now and restrict access to any exposed filter endpoints.
  • Mitigation: Upgrade immediately; if patching is delayed, place the site behind stricter WAF rules and monitor database error patterns.

CVE-2026-111402: Newsletters SQL injection

  • Impact: Attackers may read or alter database contents, including subscriber data and admin-related records.
  • Affected Systems: Newsletters versions through 4.18.1.
  • Immediate Action: Treat as urgent if the plugin is installed on any production site handling user data.
  • Mitigation: Apply the fixed release immediately; until then, disable vulnerable functionality and review for unauthorized database access.

CVE-2026-115929: MongoDB Compass TLS root store issue

  • Impact: Users may trust problematic intermediate CA certificates, increasing the risk of TLS interception or certificate trust issues.
  • Affected Systems: MongoDB Compass versions using affected Electron builds; resolved in Compass 1.53.1 with Electron 44.9.1.
  • Immediate Action: Upgrade Compass on all developer and admin endpoints.
  • Mitigation: Move to version 1.53.1 or later and verify endpoint certificate policies.

CVE-2026-112844: WP Event Solution stored XSS

  • Impact: Attackers can store malicious script that runs in an admin’s browser, enabling session theft or unauthorized actions.
  • Affected Systems: WP Event Solution versions through 4.1.26.
  • Immediate Action: Update immediately and review event content for injected script.
  • Mitigation: Patch, then clear cached pages and log out active admin sessions if compromise is suspected.

CVE-2026-114695: VOD Infomaniak stored XSS

  • Impact: Malicious content may execute in a user’s browser and steal session data or alter page content.
  • Affected Systems: VOD Infomaniak versions through 1.5.14.
  • Immediate Action: Upgrade the plugin and inspect recent uploaded or edited content.
  • Mitigation: Apply the vendor fix and purge any cached pages that may preserve injected payloads.

CVE-2026-115807: User Profile Builder limited privilege escalation

  • Impact: Authenticated attackers with Author-level access or higher can create accounts with elevated roles such as Editor.
  • Affected Systems: User Profile Builder versions through 4.0.3.
  • Immediate Action: Review all recent account creations and role changes immediately.
  • Mitigation: Update to the fixed version and restrict form-based account creation until patched.

CVE-2026-112869: We’re Open! reflected XSS

  • Impact: Attackers can craft links that execute script in a victim’s browser.
  • Affected Systems: We’re Open! versions through 2.6.
  • Immediate Action: Patch and warn staff not to click untrusted links to affected pages.
  • Mitigation: Upgrade, then validate that query parameters are properly sanitized.

CVE-2026-114697: QA Analytics stored XSS

  • Impact: Stored malicious script can run for any user who views the affected analytics content.
  • Affected Systems: QA Analytics versions through 5.3.0.1.
  • Immediate Action: Update the plugin and check dashboards for suspicious injected content.
  • Mitigation: Patch immediately and clear browser/site caches.

CVE-2026-114178: W3 Total Cache stored XSS

  • Impact: Attackers may inject script into cached or displayed content, targeting administrators and visitors.
  • Affected Systems: W3 Total Cache versions through 2.10.7.
  • Immediate Action: Upgrade now and purge all caches.
  • Mitigation: Apply the fixed release and verify cache-related admin settings.

CVE-2026-114694: Events Manager reflected XSS

  • Impact: A malicious URL can trigger script execution in a victim’s browser.
  • Affected Systems: Events Manager versions through 7.4.8.
  • Immediate Action: Patch immediately and block suspicious inbound links to event pages.
  • Mitigation: Update to the fixed version and review web logs for exploit attempts.

CVE-2026-114179: BP Better Messages DOM-based XSS

  • Impact: Script can execute in the browser through client-side manipulation, risking message theft and account abuse.
  • Affected Systems: BP Better Messages versions through 3.1.3.
  • Immediate Action: Update immediately and test messaging flows for unsafe URL or DOM handling.
  • Mitigation: Apply the fix and review browser-side sanitization controls.

Previously Alerted

What to Do Now

  1. Patch or disable affected plugins immediately, starting with deserialization and SQL injection flaws.
  2. Remove unused WordPress plugins from production sites instead of leaving them inactive.
  3. Review admin accounts, recent comments, exports, and role changes for signs of exploitation.
  4. Purge caches and rotate credentials if you suspect XSS or privilege escalation exposure.
  5. Apply WAF rules and temporary access controls where patching cannot happen right away.

Verification steps: Confirm installed versions against the affected ranges, verify no vulnerable plugin remains active, and check logs for comment submissions, unusual export/restore actions, SQL errors, and unexpected admin logins.

Monitoring recommendations: Watch for new administrator creation, role drift, suspicious outbound requests, injected script indicators, and repeated requests to plugin endpoints. If a site handles payments, memberships, or user accounts, increase monitoring immediately.

Related Resources

  • Internal blog post: WordPress Plugin Risk Response Playbook (to be published)
  • Internal blog post: Emergency Triage Guide for Deserialization and SQL Injection (to be published)
  • Official vendor advisories: check the plugin vendor security pages and WordPress plugin repository changelogs for fixed releases.
  • Official vendor advisories: review MongoDB Compass release notes for 1.53.1 and later.

Keep reading