Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs in CMS platforms, plugins, and e-commerce software — WordPress, Magento, WooCommerce and more — so you know when something could affect your website.

CRITICAL 9.1 CVE-2026-120213 2 Nov 2026

@fastify/http-proxy Path-Restriction Bypass Vulnerability

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real…

CRITICAL 9.9 CVE-2026-120322 2 Nov 2026

Termix-SSH Termix File Manager Path Traversal Vulnerability

SSH client/file manager tool, not a CMS, web framework, web server, or website application.

CRITICAL 9.3 CVE-2026-62048 1 Nov 2026

BookIt WordPress Plugin SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

CRITICAL 9.8 CVE-2026-120209 31 Oct 2026

AJ-Report Hard-Coded JWT Secret Remote Code Execution Vulnerability

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

CRITICAL 9.8 CVE-2026-120201 31 Oct 2026

Jpom Authentication Bypass Lets Attackers Gain Super-Admin Access

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

CRITICAL 9.8 CVE-2026-118235 31 Oct 2026

SimpleForm WordPress Plugin Arbitrary File Upload Vulnerability

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload…

CRITICAL 9.1 CVE-2026-103882 31 Oct 2026

Acadlix LMS WordPress Plugin Arbitrary File Deletion Vulnerability

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is del…

CRITICAL 9.8 CVE-2026-119096 31 Oct 2026

Uncanny Toolkit for LearnDash Authentication Bypass Vulnerability

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()`…

CRITICAL 9.8 CVE-2026-116512 31 Oct 2026

WordPress Project Manager Plugin Remote Code Execution Vulnerability

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unau…

CRITICAL 9.1 CVE-2026-89270 31 Oct 2026

WordPress Popup Builder Plugin Authorization Bypass Lets Attackers Trash Popups

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(),…

CRITICAL 9.1 CVE-2026-116557 31 Oct 2026

WordPress Booking Calendar Plugin Missing Capability Check Lets Subscribers Delete Notes

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.

CRITICAL 9.8 CVE-2026-109220 31 Oct 2026

WordPress WooCommerce PDF Invoice Plugin PHP Object Injection Vulnerability

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without va…

CRITICAL 9.1 CVE-2026-55598 30 Oct 2026

PinePods Podcast Manager SSRF Vulnerability

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podca…

CRITICAL 9.9 CVE-2026-116241 30 Oct 2026

pgAdmin 4 Import/Export Data Command Injection Vulnerability

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conf…

CRITICAL 9.8 CVE-2026-90888 30 Oct 2026

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com