Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs with a critical CVSS score so you know when something could affect your servers.

CRITICAL 9.8 CVE-2026-13598 23 Aug 2026

WordPress RestrictMate Plugin Admin Takeover

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover.

CRITICAL 9.8 CVE-2026-4703 22 Aug 2026

WordPress WS Form LITE PHP Object Injection

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on

CRITICAL 9.8 CVE-2026-78003 22 Aug 2026

Mailgun WordPress Plugin SSRF Vulnerability

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress sit

CRITICAL 9.8 CVE-2026-77002 22 Aug 2026

WordPress SmilePass Selfie Login Auth Bypass

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

CRITICAL 9.8 CVE-2026-77001 22 Aug 2026

WordPress SoClever Social Login Plugin Unauthenticated Admin Session Access

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.

CRITICAL 9.8 CVE-2026-77000 22 Aug 2026

WordPress WP Social Media Login Plugin Unauthenticated User Login

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.

CRITICAL 9.1 CVE-2026-49849 21 Aug 2026

Laravel-based xShop RCE via File Upload

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.

CRITICAL 9.6 CVE-2026-77087 21 Aug 2026

Paperclip Local DNS Rebinding Vulnerability

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.

CRITICAL 9.8 CVE-2026-77806 21 Aug 2026

SPIP CMS Arbitrary Code Execution

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

CRITICAL 9.8 CVE-2026-77264 21 Aug 2026

WordPress WooCommerce Plugin Authentication Bypass

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the secret magic login token in the response to a publicly accessible OTP request, rather than only delivering it to the user's email address. This makes it possible for unauthenticated attackers to log in as any user on the

CRITICAL 9.8 CVE-2026-77647 20 Aug 2026

SPIP Arbitrary Code Execution Vulnerability

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

CRITICAL 9.8 CVE-2026-72843 20 Aug 2026

EverShop Customer Account Takeover

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to

CRITICAL 9.6 CVE-2026-28164 20 Aug 2026

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com

Critical vulnerabilities, as they're published

WordPress RestrictMate Plugin Admin Takeover

WordPress WS Form LITE PHP Object Injection

Mailgun WordPress Plugin SSRF Vulnerability

WordPress SmilePass Selfie Login Auth Bypass

WordPress SoClever Social Login Plugin Unauthenticated Admin Session Access

WordPress WP Social Media Login Plugin Unauthenticated User Login

Laravel-based xShop RCE via File Upload

Paperclip Local DNS Rebinding Vulnerability

SPIP CMS Arbitrary Code Execution

WordPress WooCommerce Plugin Authentication Bypass

SPIP Arbitrary Code Execution Vulnerability

EverShop Customer Account Takeover

HashThemes Easy Elementor Addons CSRF Vulnerability

Shopify App Arbitrary File Upload

WordPress Smart Cleaning Plugin Arbitrary File Upload

IT Residence 3.2.1 Arbitrary File Upload

WordPress Membership Pro Broken Auth Bug

FundEngine PHP Object Injection

WordPress Query Wrangler Plugin RCE

BookingPress Plugin SQL Injection

Think your server has been compromised?