Security Digest: November 7, 2026 - 168 Critical Vulnerabilities

Today’s risk is severe: a wave of critical flaws includes a CVSS 10 authorization bypass in Microsoft Entra Device Registration and a long list of remote code execution, authentication bypass, SSRF, SQL injection, and tenant-isolation failures in IBM API Connect. Multiple WordPress plugins also expose sites to unauthenticated file upload and stored XSS paths.

· 7 min read

November 7, 2026: Widespread Exposure Across IBM API Connect, Microsoft Entra, and WordPress Plugins

Today’s risk is severe: a wave of critical flaws includes a CVSS 10 authorization bypass in Microsoft Entra Device Registration and a long list of remote code execution, authentication bypass, SSRF, SQL injection, and tenant-isolation failures in IBM API Connect. Multiple WordPress plugins also expose sites to unauthenticated file upload and stored XSS paths. Patch first, then verify exposure, then hunt for abuse.

Executive Summary

Today’s disclosures are dominated by two patterns: identity and authorization failures in Microsoft and IBM products, and internet-facing WordPress plugin flaws that can lead directly to code execution or session compromise. If you run any affected version, treat this as an emergency patch cycle and assume exposed services are being probed already.

Immediate priorities: update affected platforms, disable or restrict vulnerable features where patches are not yet applied, and review logs for suspicious authentication, upload, and outbound-request activity.

Critical Vulnerabilities

  • CVE-2026-109469: Entra Device Registration authorization bypass
    • Impact: Unauthorized privilege elevation over the network.
    • Affected Systems: Microsoft Entra Device Registration.
    • Immediate Action: Apply Microsoft’s fix immediately and review device-registration and privileged-access logs.
    • Mitigation: Restrict exposure, enforce least privilege, and monitor for unexpected role changes.
  • CVE-2026-17146 / 17298 / 17342 / 17117 / 17359 / 17392 / 17399 / 17402 / 17336 / 17132 / 17410 / 16920 / 17147 / 16884 / 17239 / 17134 / 17049 / 17354 / 17158 / 17150 / 17340 / 17360 / 17278 / 17362 / 16720 / 17301 / 17408 / 17313: IBM API Connect critical chain
    • Impact: Remote code execution, SSRF, SQL injection, auth bypass, tenant escape, arbitrary file writes/reads, and full admin takeover.
    • Affected Systems: IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2, with some issues limited to 12.1.x.
    • Immediate Action: Upgrade to the latest fixed IBM release now; if you cannot patch immediately, isolate management interfaces and restrict access to trusted admin networks only.
    • Mitigation: Disable unneeded features, rotate credentials and tokens, and inspect for anomalous tenant access, outbound requests, and file-system changes.
  • CVE-2026-19803: Printcart Store arbitrary file upload
    • Impact: Unauthenticated attackers can write PHP content and gain remote code execution.
    • Affected Systems: Printcart Store – Web to Print Product Designer for WooCommerce up to 2.13.2 when Advanced Upload Popup is enabled.
    • Immediate Action: Disable the affected popup mode or remove the plugin until patched.
    • Mitigation: Block public upload endpoints and verify uploads for unexpected PHP files.
  • CVE-2026-93754: payever WooCommerce Gateway arbitrary file upload
    • Impact: Unauthenticated remote code execution via public callbacks and file upload.
    • Affected Systems: payever WooCommerce Gateway up to 4.8.0.
    • Immediate Action: Deactivate the plugin or remove public access to the vulnerable callbacks immediately.
    • Mitigation: Audit uploads directory for executable files and rotate any exposed API tokens.
  • CVE-2026-103900: WPJAM Basic privilege escalation
    • Impact: Unauthenticated users can create administrator accounts in certain configurations.
    • Affected Systems: WPJAM Basic up to 7.1 with social login/open registration enabled.
    • Immediate Action: Disable public signup or remove the plugin until fixed.
    • Mitigation: Review newly created accounts and revoke unexpected admin roles.

What to Do Now

  1. Patch the highest-risk systems first: Microsoft Entra Device Registration, IBM API Connect, and any exposed WordPress plugins listed above.
  2. Reduce exposure immediately: limit admin interfaces to VPN or trusted IPs, disable vulnerable upload or registration features, and remove unused plugins.
  3. Rotate secrets: reset credentials, API keys, tokens, and service accounts tied to affected systems.
  4. Hunt for abuse: look for new admin users, unexpected outbound HTTP requests, suspicious uploads, SQL errors, and unusual tenant-crossing activity.
  5. Validate fixes: confirm versions match vendor-fixed releases and re-scan externally reachable services.

Verification steps: inventory all IBM API Connect deployments and WordPress sites, confirm version numbers, and check whether public-facing features such as registration, uploads, or API callbacks are enabled. Review logs for signs of SSRF, path traversal, command execution, and account creation spikes.

Monitoring recommendations: alert on new admin-role assignments, file writes under web roots, repeated auth failures, suspicious redirects, and any outbound traffic from API management hosts to internal or metadata endpoints.

Related Resources

  • Internal: a follow-up analysis on today’s IBM API Connect exposure is planned; internal WordPress hardening guidance will be published separately.
  • Official vendor advisories: Microsoft Security Update Guide, IBM Security Bulletins, and the affected plugin vendors’ release notes.

Keep reading