Security Digest: October 31, 2026 - 73 Critical Vulnerabilities

Today’s risk is broad and immediate: attackers have multiple paths to remote code execution, authentication bypass, privilege escalation, and data theft across WordPress plugins, developer libraries, and CI/CD tooling. Several flaws are unauthenticated and trivial to exploit because the required nonce, token, or setup step is exposed to any visitor.

· 20 min read

Executive Summary

Today’s risk is broad and immediate: attackers have multiple paths to remote code execution, authentication bypass, privilege escalation, and data theft across WordPress plugins, developer libraries, and CI/CD tooling. Several flaws are unauthenticated and trivial to exploit because the required nonce, token, or setup step is exposed to any visitor. Patch exposed systems now, especially WordPress sites, build pipelines, and any service parsing untrusted files, PEM, ASN.1, PDFs, or OAuth/SAML flows.

Note: one previously alerted CVE is listed below only for reference and is not re-summarized.

Critical Vulnerabilities

  • CVE-2026-118235: WordPress SimpleForm arbitrary file upload
    • Impact: Unauthenticated attackers can upload executable files and potentially gain remote code execution.
    • Affected Systems: SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications ≤ 3.10.2.
    • Immediate Action: Disable the plugin or remove public form pages until patched.
    • Mitigation: Upgrade to a fixed release as soon as available; verify upload restrictions and file-type allowlists.
  • CVE-2026-119096: Uncanny Toolkit for LearnDash login bypass
    • Impact: Attackers with valid credentials can log in to unverified or suspended accounts.
    • Affected Systems: Uncanny Toolkit for LearnDash ≤ 3.8.2.
    • Immediate Action: Treat account-approval controls as bypassed and restrict access immediately.
    • Mitigation: Update to a patched version; force password resets for sensitive accounts.
  • CVE-2026-109220: WooCommerce PDF Invoice object injection
    • Impact: Unauthenticated attackers can reach code execution through checkout data.
    • Affected Systems: PDF Invoice for WooCommerce + Drag and Drop Template Builder ≤ 7.1.1.
    • Immediate Action: Disable public checkout paths or the plugin if you cannot patch immediately.
    • Mitigation: Upgrade and inspect recent orders for suspicious checkout notes.
  • CVE-2026-63377: TAKO AI Agent first-admin takeover
    • Impact: A remote attacker can create the first admin account and take full control.
    • Affected Systems: TAKO AI Agent for Okta prior to 3.0.1-beta.
    • Immediate Action: Block public access to setup endpoints and verify no unauthorized admin exists.
    • Mitigation: Upgrade to 3.0.1-beta or later.
  • CVE-2026-117656: pow-auth Apple sign-in impersonation
    • Impact: Attackers can impersonate another user by tampering with callback data.
    • Affected Systems: assent 0.1.25 through 0.3.1.
    • Immediate Action: Disable Sign in with Apple flows if you rely on this library.
    • Mitigation: Upgrade to 0.3.2 or later; validate identity only from signed claims.
  • CVE-2026-103882: Acadlix LMS arbitrary file deletion
    • Impact: Authenticated users can delete arbitrary server files, potentially leading to RCE.
    • Affected Systems: Acadlix LMS ≤ 1.1.9.
    • Immediate Action: Restrict low-privilege accounts and disable the vulnerable REST route if possible.
    • Mitigation: Patch immediately; monitor for deletion attempts targeting core files.
  • CVE-2026-116557: WP Booking System note deletion
    • Impact: Subscribers can delete calendar notes belonging to any calendar.
    • Affected Systems: WP Booking System ≤ 2.1.0.5.
    • Immediate Action: Limit subscriber access and review calendar integrity.
    • Mitigation: Upgrade to the fixed release.
  • CVE-2026-89270: Popup Builder authorization bypass
    • Impact: Unauthenticated attackers can trash all published popups in one request.
    • Affected Systems: Popup Builder ≤ 4.4.5.
    • Immediate Action: Remove public exposure or disable the plugin until patched.
    • Mitigation: Apply the vendor fix and verify popup integrity backups.
  • CVE-2026-116672: Authlib client configuration bypass
    • Impact: Developers can accidentally ship an OAuth registration authorization bypass.
    • Affected Systems: Authlib 1.7.2.
    • Immediate Action: Audit any custom RFC 7592 implementation immediately.
    • Mitigation: Upgrade to 1.9.1 and ensure token-to-client binding is enforced.
  • CVE-2026-63339: IXP Manager privilege escalation
    • Impact: Non-admin users can elevate to administrator.
    • Affected Systems: IXP Manager prior to 7.3.0.
    • Immediate Action: Review all non-admin accounts for suspicious privilege changes.
    • Mitigation: Upgrade to 7.3.0.
  • CVE-2026-104012: Rox Appointment Booking mass assignment
    • Impact: Attackers can poison customer records and ultimately take over admin accounts.
    • Affected Systems: Rox Appointment Booking ≤ 1.3.1.
    • Immediate Action: Audit customer records for unexpected wp_user_id values.
    • Mitigation: Patch and review admin email reset activity.
  • CVE-2026-120070: User Frontend shortcode privilege escalation
    • Impact: Attackers can inject a registration shortcode and mint privileged WordPress accounts.
    • Affected Systems: User Frontend ≤ 4.3.13.
    • Immediate Action: Search recent posts for unexpected registration shortcodes.
    • Mitigation: Upgrade and disable public post submission if not needed.
  • CVE-2026-63378: TAKO AI Agent script execution
    • Impact: Authenticated users can execute arbitrary Python code and compromise the service.
    • Affected Systems: TAKO AI Agent prior to 3.0.1-beta.
    • Immediate Action: Restrict access to script execution APIs now.
    • Mitigation: Upgrade to 3.0.1-beta and rotate exposed secrets.
  • CVE-2026-116086: konflux-ci workflow information disclosure
    • Impact: Crafted issue titles can expose secrets in workflow logs.
    • Affected Systems: konflux-ci deployments with affected workflow scripts.
    • Immediate Action: Stop processing untrusted issue titles in automation.
    • Mitigation: Apply vendor guidance and scrub logs for leaked credentials.
  • CVE-2026-76010: NextGEN Gallery RCE
    • Impact: Authenticated users can reach code execution through gallery metadata abuse.
    • Affected Systems: NextGEN Gallery ≤ 4.4.1.
    • Immediate Action: Review gallery ownership and revoke unnecessary gallery permissions.
    • Mitigation: Upgrade and inspect gallery metadata for tampering.
  • CVE-2026-63396: Coop GraphQL data exposure
    • Impact: Unauthenticated attackers can enumerate organization and reviewer data.
    • Affected Systems: Coop prior to 1.0.0.
    • Immediate Action: Restrict public GraphQL access immediately.
    • Mitigation: Upgrade to 1.0.0 and place the service behind authentication.
  • CVE-2026-110176: Drupal File Force Download access bypass
    • Impact: Unauthenticated users can retrieve files they should not access.
    • Affected Systems: File Force Download 7.1.0 through 7.1.2.
    • Immediate Action: Disable temporary-file download links now.
    • Mitigation: Upgrade and confirm private/public file routing rules.
  • CVE-2026-63346 / 63345 / 63344: Refitter code-generation injection
    • Impact: Malicious OpenAPI input can generate attacker-controlled C# that runs at load time.
    • Affected Systems: Refitter prior to 2.1.2.
    • Immediate Action: Stop generating clients from untrusted specs immediately.
    • Mitigation: Upgrade to 2.1.2 and revalidate all API descriptions.
  • CVE-2026-116964: konflux-ci CI/CD code execution
    • Impact: Repository writers can execute arbitrary code in CI/CD and steal deployment secrets.
    • Affected Systems: konflux-ci environments with affected sync scripts.
    • Immediate Action: Revoke runner secrets and review recent pipeline runs.
    • Mitigation: Patch and harden shell evaluation in export scripts.
  • CVE-2026-63338: IXP Manager API-key record access
    • Impact: Users can access or edit another user’s API key record.
    • Affected Systems: IXP Manager prior to 7.3.0.
    • Immediate Action: Rotate exposed API keys and review access logs.
    • Mitigation: Upgrade to 7.3.0.
  • CVE-2026-119977: WordPress Core upgrade-window RCE
    • Impact: Unauthenticated attackers may execute code during the upgrade window.
    • Affected Systems: WordPress Core 4.7 through 7.1.3.
    • Immediate Action: Minimize upgrade exposure and restrict public access during updates.
    • Mitigation: Apply the latest core release and verify staging paths are not web-accessible.
  • CVE-2026-103898: Wp Social Login authentication bypass
    • Impact: Attackers can obtain valid sessions as existing users, including admins.
    • Affected Systems: Wp Social Login and Register Social Counter ≤ 3.2.2.
    • Immediate Action: Disable social login callbacks if you cannot patch immediately.
    • Mitigation: Upgrade and verify email verification is enforced server-side.
  • CVE-2026-117681: konflux-ci TLS verification downgrade
    • Impact: Adjacent attackers can capture impersonation tokens and gain cluster control.
    • Affected Systems: konflux-ci deployments with the affected proxy behavior.
    • Immediate Action: Review internal proxy TLS settings and network exposure.
    • Mitigation: Patch and require trusted internal CAs.
  • CVE-2026-63414: Shopify App tenant confusion
    • Impact: Requests can be misrouted to the wrong shop context and leak or alter tenant data.
    • Affected Systems: shopify_app token-exchange 22.1.0 through 23.0.2.
    • Immediate Action: Stop trusting request-supplied shop values for authorization.
    • Mitigation: Upgrade to 23.0.3.
  • CVE-2026-119196 / 119197 / 119194 / 119195 / 119119? and related pyasn1 flaws
    • Impact: Crafted ASN.1 can cause CPU exhaustion, hangs, or excessive memory use.
    • Affected Systems: pyasn1 0.6.4 and earlier, depending on the decoder path.
    • Immediate Action: Block oversized untrusted ASN.1 input at the application boundary.
    • Mitigation: Upgrade to pyasn1 0.6.5 and enforce strict size limits.
  • CVE-2026-118759 / 118761: Kubeflow Pipelines authorization and decompression issues
    • Impact: Attackers can read logs or exhaust memory via archive uploads.
    • Affected Systems: Kubeflow Pipelines through 2.17.3.
    • Immediate Action: Restrict backend access and upload endpoints now.
    • Mitigation: Upgrade to 2.18.0.
  • CVE-2026-118779 / 118782 / 119187 / 119190: node-forge TLS/PEM/PKCS#12 flaws
    • Impact: Attackers can crash Node.js services, bypass certificate validation, or forge PKCS#12 integrity checks.
    • Affected Systems: node-forge 1.4.0 and earlier.
    • Immediate Action: Prioritize any service that parses attacker-supplied PEM, TLS, or PKCS#12 data.
    • Mitigation: Upgrade to 1.4.1 immediately.
  • CVE-2026-120040: Mail logging & Catcher password-reset exposure
    • Impact: Low-privilege users can harvest reset keys and take over admin accounts.
    • Affected Systems: Mail logging & Catcher ≤ 2.2.0 when configured to expose logs to low roles.
    • Immediate Action: Restrict log visibility to administrators now.
    • Mitigation: Patch and rotate any exposed reset tokens.
  • CVE-2026-119163 / 109197 / 120194: SQL injection and JSONPath DoS
    • Impact: Attackers can steal data from databases or hang services with crafted expressions.
    • Affected Systems: FunnelKit Automations, WP Directory Kit, json-glib deployments using attacker-controlled JSONPath.
    • Immediate Action: Sanitize all externally supplied IDs and expressions immediately.
    • Mitigation: Patch affected packages and review query logs for abuse.
  • CVE-2026-63398: Coop SAML cross-tenant account takeover
    • Impact: An attacker controlling a matching IdP certificate can log in as a victim user.
    • Affected Systems: Coop prior to 1.0.2 under unusual SAML certificate reuse conditions.
    • Immediate Action: Audit SAML certificate reuse across organizations.
    • Mitigation: Upgrade to 1.0.2.
  • CVE-2026-116755: SoftIron HyperCloud command injection
    • Impact: Authenticated management-plane users can execute OS commands on hypervisor hosts.
    • Affected Systems: SoftIron HyperCloud Orchestrator 1.0 through 2.6.17.
    • Immediate Action: Restrict management-plane access and review VM template content.
    • Mitigation: Upgrade to 2.6.18.
  • CVE-2026-118763: @sigstore/oci cross-host credential leak
    • Impact: Registry credentials can be sent to an attacker-controlled upload host.
    • Affected Systems: @sigstore/oci at current vulnerable HEAD.
    • Immediate Action: Stop using untrusted registries for artifact pushes.
    • Mitigation: Require host checks before uploads and patch the library.
  • CVE-2026-119065 / 119089 / 119162 / 120114 / 109997 / 109234 / 107759 / 118057 / 107653 / 116548 / 116520 / 118070 / 110530 / 120075 / 107750 / 111254 / 115840 / 116522: WordPress stored XSS wave
    • Impact: Attackers can inject scripts that execute in admin or visitor browsers, enabling session theft and follow-on compromise.
    • Affected Systems: Multiple WordPress plugins including Shipping Zones by Drawing, ThirstyAffiliates, User Submitted Posts, Debug Log Manager, Ninja Forms, Meow Lightbox, WPO365 Mailer, Shield Security, SureCart, VikRentCar, PPWP, Welcart, FeedWordPress, WP Activity Log, PDF Invoices & Packing Slips, W3 Total Cache, Relevanssi, and others listed above.
    • Immediate Action: Patch every affected plugin or disable it until fixed; review admin sessions and recent content submissions.
    • Mitigation: Apply vendor updates, clear caches, and audit stored content for injected payloads.
  • CVE-2026-119205 / 119206 / 119209 / 119207 / 119208 / 119203 / 119204: pypdf parsing flaws
    • Impact: Crafted PDFs can trigger infinite loops, high memory use, or long runtimes.
    • Affected Systems: pypdf versions fixed in 6.21.3 and 6.21.4.
    • Immediate Action: Block untrusted PDFs from automated processing until patched.
    • Mitigation: Upgrade to the fixed pypdf release matching the issue.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first: WordPress sites, CI/CD runners, OAuth/SAML services, and any service parsing untrusted files or PDFs.
  2. Disable or isolate vulnerable plugins and services if patching is not immediate.
  3. Rotate secrets and sessions where authentication bypass, credential leakage, or admin takeover is possible.
  4. Verify exposure by checking versions, public endpoints, and whether setup, upload, callback, or parsing routes are reachable without strong auth.
  5. Monitor logs now for suspicious uploads, repeated login/callback attempts, unexpected admin creation, file deletions, and unusual PDF/ASN.1/PEM parsing failures.

Verification steps: inventory affected versions, confirm patch status, and test that public endpoints no longer accept unauthenticated setup, upload, or callback requests. For WordPress, confirm plugin versions from the admin dashboard and scan recent content, orders, comments, and logs for injected payloads. For developer libraries, search dependency manifests and rebuild artifacts after upgrading.

Monitoring recommendations: alert on new admin accounts, password-reset requests, file deletions, sudden CPU spikes in parsers, abnormal Node.js process exits, and outbound requests to unexpected registry or storage hosts.

Related Resources

  • Internal: a deeper follow-up on WordPress plugin exposure and a separate note on developer-library parser risks will be published soon.
  • Official advisories: vendor release notes for WordPress plugins, Authlib, node-forge, pyasn1, pypdf, Kubeflow Pipelines, and the TAKO AI Agent project.

Keep reading