Security Digest: November 3, 2026 - 16 Critical Vulnerabilities

Today’s alert is dominated by account-takeover, authentication-bypass, and file-deletion flaws across WordPress plugins, ManageEngine products, and enterprise identity tools. Several issues are exploitable without authentication, and multiple WordPress flaws can escalate to full site compromise if registration, checkout, or public AJAX paths are exposed.

· 12 min read

Executive Summary

Today’s alert is dominated by account-takeover, authentication-bypass, and file-deletion flaws across WordPress plugins, ManageEngine products, and enterprise identity tools. Several issues are exploitable without authentication, and multiple WordPress flaws can escalate to full site compromise if registration, checkout, or public AJAX paths are exposed. Prioritize patching internet-facing systems first, then verify admin accounts, collector registrations, and exposed REST endpoints.

Critical Vulnerabilities

  • CVE-2026-4052: WSO2 Identity Server / API Manager token abuse

    • Impact: A self-registered user may obtain access to WSO2 API Manager System REST APIs.
    • Affected Systems: WSO2 Identity Server deployments using Resident Key Manager with database sharing.
    • Immediate Action: Identify any deployment using this architecture and restrict self-registration and token issuance paths immediately.
    • Mitigation: Apply the vendor patch or workaround from WSO2; disable self-registration where possible and review API Manager API access logs for unusual token use.

  • CVE-2026-89292: Eclipse Mnestix Browser API key exposure

    • Impact: An unauthenticated attacker can exfiltrate the MNESTIX_BACKEND_API_KEY for all configured infrastructures.
    • Affected Systems: Mnestix Browser 1.6.0 through 2.2.x.
    • Immediate Action: Treat exposed API keys as compromised and rotate them now.
    • Mitigation: Upgrade to 2.3.0 or later and invalidate any keys that may have been exposed.

  • CVE-2026-121022: Axxon One default admin password bypass

    • Impact: A remote unauthenticated attacker can log in as the built-in administrator on a newly installed system.
    • Affected Systems: AxxonSoft Axxon One before 3.0.0 on Windows and Linux.
    • Immediate Action: Check for newly deployed systems and assume the default admin account is exposed until patched.
    • Mitigation: Upgrade to 3.0.0 or later and force password reset / account review on all new installations.

  • CVE-2026-13594: ManageEngine Log360 / EventLog Analyzer unauthorized access

    • Impact: An adversary may gain unauthorized access to the product.
    • Affected Systems: Log360 and EventLog Analyzer 13062 and below.
    • Immediate Action: Restrict access to admin consoles and patch affected instances immediately.
    • Mitigation: Upgrade beyond 13062 and review authentication logs for suspicious logins.

  • CVE-2026-120518: BuddyPress XProfile Image Field arbitrary file deletion

    • Impact: Unauthenticated attackers can delete arbitrary files, potentially leading to remote code execution if critical files are removed.
    • Affected Systems: BuddyPress XProfile Image Field plugin up to and including 3.1.0.
    • Immediate Action: Disable open registration if enabled and remove the plugin until patched.
    • Mitigation: Upgrade to a fixed version; monitor for deleted core files such as wp-config.php.

  • CVE-2026-71450: Johnson Controls EasyIO Neo EC / CW Edge authentication bypass

    • Impact: Attackers can bypass authentication on affected controllers.
    • Affected Systems: EasyIO Neo EC 3.3b62 through 3.3b63; CW 3.3b24 through 3.3b25.
    • Immediate Action: Isolate exposed controllers and verify firmware level.
    • Mitigation: Apply the vendor update and limit network access to management interfaces.

  • CVE-2026-105981: Digital I/O command injection

    • Impact: A high-privilege remote attacker can inject OS commands and execute them as root.
    • Affected Systems: Products using the vulnerable Digital I/O function (vendor advisory required for exact scope).
    • Immediate Action: Restrict privileged access immediately and review any exposed management APIs.
    • Mitigation: Patch as soon as the vendor release is available; segment and monitor the management plane.

  • CVE-2026-120538: Easy Digital Downloads account takeover

    • Impact: An unauthenticated attacker can obtain an authenticated session as another WordPress user, including administrators.
    • Affected Systems: Easy Digital Downloads up to and including 3.7.2.
    • Immediate Action: Disable guest checkout or PayPal flows if possible until patched.
    • Mitigation: Upgrade immediately; review admin sessions and reset credentials for potentially affected accounts.

  • CVE-2026-120574: SureCart unauthenticated account takeover

    • Impact: Attackers can brute-force a one-time code and log in as any user, including admins.
    • Affected Systems: SureCart up to and including 4.9.5.
    • Immediate Action: Disable passwordless login routes or restrict them at the edge if possible.
    • Mitigation: Upgrade to a fixed release and add rate limiting and lockout controls immediately.

  • CVE-2026-120577: FluentCart arbitrary file deletion

    • Impact: Authenticated attackers with custom-level access can delete arbitrary files, which may lead to full compromise.
    • Affected Systems: FluentCart up to and including 1.6.2.
    • Immediate Action: Remove unnecessary elevated WordPress roles and patch quickly.
    • Mitigation: Upgrade to a fixed version and watch for deletion of critical files.

  • CVE-2026-77800: ManageEngine Key Manager Plus SAML bypass

    • Impact: Attackers can log in using SAML assertions intended for another service provider.
    • Affected Systems: Key Manager Plus before build 7151.
    • Immediate Action: Disable or tightly restrict SAML access until patched.
    • Mitigation: Upgrade to 7151 or later and validate SAML configuration and trust relationships.

  • CVE-2026-16900: ManageEngine Log360 / EventLog Analyzer collector registration bypass

    • Impact: An unauthenticated actor can register a local collector.
    • Affected Systems: Log360 and EventLog Analyzer 13071 and below.
    • Immediate Action: Review collector registrations now and block untrusted registration traffic.
    • Mitigation: Patch beyond 13071 and audit for unexpected collectors or data paths.

  • CVE-2026-120559: Contact Form Extender for Divi Builder arbitrary file deletion

    • Impact: Unauthenticated attackers can delete arbitrary files using a public nonce.
    • Affected Systems: Contact Form Extender for Divi Builder up to and including 1.0.6.
    • Immediate Action: Disable the plugin or the affected AJAX action until fixed.
    • Mitigation: Upgrade immediately and review for file integrity issues.

  • CVE-2026-77799: ManageEngine Key Manager Plus 2FA bypass

    • Impact: Attackers with valid credentials can bypass the verification code step.
    • Affected Systems: Key Manager Plus before build 7150.
    • Immediate Action: Force password resets for privileged users and tighten access to the console.
    • Mitigation: Upgrade to 7150 or later and verify 2FA enforcement.

  • CVE-2026-120830: libslirp memory disclosure

    • Impact: A malformed ICMP packet can leak host memory to a guest or container.
    • Affected Systems: Systems using vulnerable libslirp builds (common in virtualization and container networking stacks).
    • Immediate Action: Prioritize patching hosts that run untrusted guests or containers.
    • Mitigation: Update libslirp and review exposure of guest networking features.

  • CVE-2026-120558: Advanced Shipment Tracking for WooCommerce SQL injection

    • Impact: Authenticated attackers with Shop Manager access can inject SQL and extract sensitive database data.
    • Affected Systems: Advanced Shipment Tracking for WooCommerce up to and including 3.9.
    • Immediate Action: Restrict Shop Manager access and inspect database activity for abuse.
    • Mitigation: Upgrade immediately and rotate credentials if database exposure is suspected.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first, especially WordPress plugins, ManageEngine products, WSO2, and exposed controllers.
  2. Disable or restrict risky features: open registration, guest checkout, passwordless login, SAML trust paths, and public collector registration.
  3. Rotate credentials and API keys for any system affected by account takeover or secret exposure.
  4. Review logs immediately for unexpected admin sessions, file deletions, collector registrations, and unusual API calls.
  5. Validate file integrity on WordPress and appliance systems; look for missing core files and unexplained webshells.

Verification steps: confirm version numbers against the affected ranges, check whether exposed services are reachable from the internet, and verify that patches were applied to all clustered or replicated nodes. If you cannot patch immediately, isolate the system and block external access to the affected feature.

Monitoring recommendations: alert on new administrator logins, password resets, SAML assertions, collector registrations, and file deletions. Watch for spikes in failed one-time-code attempts, guest checkout abuse, and unusual outbound traffic from web servers.

Related Resources

  • Internal blog posts: planned coverage on WordPress plugin exploitation, identity-system hardening, and ManageEngine incident response.
  • Official vendor advisories: WSO2, Eclipse Mnestix, AxxonSoft, Zoho/ManageEngine, Johnson Controls, and WordPress plugin vendor security notices.

Keep reading