WordPress: 25 Plugin Vulnerabilities Including Critical RCE Disclosed in Single Batch
A batch of 25 WordPress plugin vulnerabilities, including critical RCE and XSS flaws, were disclosed on August 27-28, 2026, posing significant risks to user sites.
Key findings
- 25 WordPress plugins disclosed with vulnerabilities between August 27-28, 2026.
- Critical vulnerabilities include RCE and PHP Object Injection in plugins like Tutor LMS, Hash Form, and Geo Controller.
- Multiple Stored XSS flaws found in popular plugins such as Optimole, TranslatePress, and LiteSpeed Cache.
- SQL Injection and Broken Access Control issues affect plugins like Suggestion Engine for WooCommerce and Kali Forms.
- Patched versions are available for most affected plugins; prompt updates are essential.
On August 27-28, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a notable cluster of critical and high-severity flaws. These vulnerabilities, disclosed within a 19-hour window, span multiple plugin categories including form builders, LMS solutions, and optimization tools, posing a substantial risk to WordPress site administrators and users. The disclosures highlight ongoing challenges in securing the vast WordPress plugin ecosystem against common web attack vectors.
Several plugins were affected by Stored Cross-Site Scripting (XSS) vulnerabilities. The Optimole plugin (CVE-2026-77365), TranslatePress (CVE-2026-76053), One User Avatar (CVE-2026-18983), LiteSpeed Cache (CVE-2026-18978), Forminator Forms (CVE-2026-18324), and Avada Builder (CVE-2026-16654) all contained flaws that could allow attackers to inject malicious scripts into web pages. These issues stem from insufficient input sanitization and output escaping, enabling authenticated or unauthenticated users to execute arbitrary scripts in a victim's browser. The LiteSpeed Cache plugin, in particular, had a flawed regular expression affecting image tag attributes, leading to XSS in versions up to 7.7 (CVE-2026-3129).
A particularly concerning group of vulnerabilities involves Remote Code Execution (RCE) and PHP Object Injection, with critical severity ratings. Tutor LMS versions prior to 4.0.6 are vulnerable to RCE through unauthenticated invocation of arbitrary zero-argument PHP functions (CVE-2026-19092). Additionally, Hash Form (CVE-2026-78292) and Geo Controller (CVE-2026-78286) plugins are susceptible to unauthenticated PHP Object Injection, both with critical CVSSv3 scores of 9.8. These types of vulnerabilities can allow attackers to execute arbitrary code on the server, leading to complete site compromise.
SQL Injection vulnerabilities were also prominent in this disclosure batch. Suggestion Engine for WooCommerce (CVE-2026-81277) and Beautiful Taxonomy Filters (CVE-2026-78288) were found to be vulnerable to SQL Injection, with the latter being unauthenticated and rated critical (CVSSv3 9.3). The Like Button Rating plugin (CVE-2026-78285) also suffered from a subscriber-level SQL Injection. These flaws allow attackers to manipulate database queries, potentially leading to data theft or modification.
Broken Access Control vulnerabilities were identified across several plugins, including Push Notification for Post and BuddyPress (CVE-2026-81279), Kali Forms (CVE-2026-81276), Ditty (CVE-2026-81274), and FluentPlayer Pro (CVE-2026-81272). These issues, ranging in severity, could allow unauthorized users to access or perform actions they should not be permitted to. Cross-Site Request Forgery (CSRF) vulnerabilities were also present in FluentBooking Pro (CVE-2026-81273) and GeoDirectory (CVE-2026-81271), both rated high, allowing attackers to trick authenticated users into performing unwanted actions.
The batch also included a critical Remote Code Execution vulnerability in Tutor LMS (CVE-2026-16759), which, while rated medium (CVSSv3 6.5), involves missing authorization on an AJAX action, potentially leading to RCE. Furthermore, Softtr Informatics Technology Trading Limited Company E-Commerce Pack (CVE-2026-5218) and CozyStay (CVE-2026-78289) were affected by basic XSS and unauthenticated XSS respectively. SureFeedback Client Site (CVE-2026-80433) suffered from a subscriber-level Sensitive Data Exposure.
The timely disclosure of these vulnerabilities, particularly the critical ones, underscores the importance of prompt patching for WordPress users. Administrators are urged to review the affected plugins and apply updates as soon as possible to mitigate the risks associated with these flaws. The variety of vulnerabilities and affected plugins highlights the need for continuous vigilance and security best practices within the WordPress ecosystem.
The patched versions for these vulnerabilities vary by plugin. For instance, Tutor LMS was patched in version 4.0.6 (CVE-2026-19092) and 4.0.5 (CVE-2026-16759). LiteSpeed Cache versions up to 7.8.1 were affected by XSS (CVE-2026-18978), and versions up to 7.7 by another XSS (CVE-2026-3129). Forminator Forms was patched in 1.57.0.1 (CVE-2026-18324). Specific version information for all 25 CVEs is crucial for administrators to identify their exposure and apply the correct patches.
This coordinated disclosure event serves as a stark reminder of the persistent security challenges in the WordPress ecosystem. Users should prioritize updating plugins, especially those with known vulnerabilities, and maintain a robust security posture to protect against potential exploits. The sheer number and severity of flaws in this single batch emphasize the need for ongoing security audits and proactive vulnerability management for all WordPress installations.