WordPress: 25 Plugin Vulnerabilities Disclosed in Single-Hour Batch
A coordinated disclosure on August 20, 2026, revealed 25 vulnerabilities in WordPress plugins, ranging from critical to high severity.
Key findings
- 25 WordPress plugin vulnerabilities disclosed on August 20, 2026, within a one-hour window.
- Vulnerabilities include critical SQL Injection, Arbitrary File Upload, RCE, and PHP Object Injection flaws.
- Multiple plugins affected by Broken Access Control and Cross-Site Scripting (XSS).
- Critical vulnerabilities impact plugins like Warehouse Cargo, Smart Cleaning, IT Residence, and User Registration & Membership Pro.
- Prompt patching and regular updates are essential for WordPress site security.
On August 20, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a tight disclosure window of just one hour. This coordinated release highlights a persistent challenge for WordPress site administrators: the need to constantly monitor and update a multitude of plugins to safeguard against diverse security threats. The vulnerabilities span critical and high severity ratings, including SQL Injection, Cross-Site Request Forgery, Broken Access Control, Arbitrary File Upload, PHP Object Injection, and Privilege Escalation, underscoring the wide attack surface presented by the plugin ecosystem.
Several plugins were found to be vulnerable to SQL Injection attacks. CVE-2026-74011, a blind SQL Injection flaw in revmakx InfiniteWP Client, and CVE-2026-74013, a subscriber SQL Injection in eShipper Commerce, are notable examples. Additionally, BookingPress Appointment Booking Pro (CVE-2026-68566), Locatoraid Store Locator (CVE-2026-66680), and Directory Pro (CVE-2026-66649) were affected by unauthenticated SQL Injection vulnerabilities, with the latter two rated as critical.
Broken Access Control was another prevalent theme, with multiple plugins exhibiting this weakness. CVE-2026-74021, CVE-2026-74020, and CVE-2026-74019 all describe unauthenticated Broken Access Control issues in Chaplin, Koji, and EPROLO Dropshipping, respectively. Homlisti (CVE-2026-66647) also suffered from subscriber-level Broken Access Control.
Critical vulnerabilities allowing for Arbitrary File Upload and Remote Code Execution were also part of this disclosure. CVE-2026-74018, CVE-2026-74016, and CVE-2026-74014 detail subscriber arbitrary file upload vulnerabilities in Warehouse Cargo, Smart Cleaning, and IT Residence, all with critical severity. Query Wrangler (CVE-2026-73992) was found to have a critical subscriber-level Remote Code Execution flaw.
PHP Object Injection and Privilege Escalation vulnerabilities were also present. CVE-2026-73993, an unauthenticated PHP Object Injection in FundEngine, and CVE-2026-66672, an unauthenticated PHP Object Injection in Flatastic, were both rated critical. Abandoned Cart Pro for WooCommerce (CVE-2026-66682) was affected by an unauthenticated Privilege Escalation vulnerability, also critical.
The batch also included Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerabilities. Easy Elementor Addons (CVE-2026-28164) was susceptible to CSRF, while WP BASE Booking (CVE-2026-73402), NotificationX Pro (CVE-2026-68564), and Flatastic (CVE-2026-66673) had subscriber or unauthenticated XSS flaws. Form Maker by 10Web (CVE-2026-66616) also had an unauthenticated XSS vulnerability.
User authentication and authorization mechanisms were targeted in several CVEs. CVE-2026-74001, an unauthenticated Broken Authentication in User Registration & Membership Pro, and CVE-2026-66677, a subscriber Broken Authentication in Leyka, were rated critical and high, respectively. MyCred New User Approve (CVE-2026-28163) suffered from a Missing Authorization vulnerability.
The coordinated disclosure of these 25 vulnerabilities on a single day emphasizes the importance of prompt patching for all WordPress plugins. Users are advised to check for updates for the affected plugins and apply them immediately to mitigate the risks associated with these critical security flaws. Staying vigilant and regularly updating all components of a WordPress site is crucial for maintaining a secure online presence. The wide range of vulnerabilities and affected plugins underscores the need for a proactive security strategy for all WordPress users.