WordPress Plugins: 25 Vulnerabilities Disclosed in Single Batch, Including Critical Flaws
A batch of 25 WordPress plugin vulnerabilities, including critical flaws like SQLi and PHP Object Injection, were disclosed on August 16-17, 2026.
Key findings
- 25 WordPress plugins disclosed with vulnerabilities between August 16-17, 2026.
- Vulnerabilities include critical SQLi, XSS, PHP Object Injection, Auth Bypass, and SSRF.
- Affected plugins range from e-commerce add-ons to page builders and LMS solutions.
- Users are urged to update plugins promptly to patch these security flaws.
- The batch highlights ongoing security risks within the diverse WordPress plugin ecosystem.
On August 16-17, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins. These vulnerabilities, spanning critical to medium severity, highlight ongoing security challenges within the WordPress ecosystem. The disclosures include issues such as SQL Injection, Cross-Site Scripting (XSS), PHP Object Injection, authorization bypass, and Server-Side Request Forgery (SSRF), affecting popular plugins like ARForms, Gallery by BestWebSoft, and Bookly.
Several plugins were found to have critical or high-severity flaws. CVE-2024-13784, a critical PHP Object Injection vulnerability in ARForms (up to 1.8.5), allows unauthenticated attackers to inject PHP objects via form submissions. Similarly, CVE-2026-18316, a critical vulnerability in Solace Extra (up to 1.6.0), involves missing capability checks that could lead to unauthorized data modification and loss. High-severity SQL Injection flaws were identified in Gallery by BestWebSoft (CVE-2026-2497, up to 4.7.9) and The School Management – Education & Learning ERP (CVE-2026-9767, up to 5.4), both stemming from insufficient input sanitization. The Bookly plugin is affected by CVE-2026-13424, a high-severity Stored XSS vulnerability.
Other notable vulnerabilities include authorization bypass issues in Kirki (CVE-2026-18347, up to 6.1.1) and WP Travel Engine (CVE-2026-17087, up to 6.8.4), allowing authenticated attackers to perform actions they shouldn't be able to. The WooMS plugin (CVE-2026-13700) suffers from SSRF, enabling attackers to disclose integration credentials. Stored XSS vulnerabilities were also found in Bold Page Builder (CVE-2026-2357, up to 5.6.8), Infility Global (CVE-2026-10734, up to 2.15.21), and SureDash (CVE-2026-18402, up to 1.10.3).
The batch also includes vulnerabilities related to data exposure and access control. CVE-2026-14832 in ShopSmart Loyalty for WooCommerce allows unauthenticated retrieval of customer loyalty profiles. CVE-2026-19728 in Extra Product Options Builder for WooCommerce permits unauthenticated access to customer-uploaded files. CVE-2026-19726 in Visualizer allows users with lower privileges to access chart configurations.
Patches and updates are available for many of these vulnerabilities. Users are strongly advised to update their WordPress plugins to the latest versions to mitigate these risks. The widespread nature of these disclosures underscores the importance of regular security audits and prompt patching for WordPress sites.
This large disclosure event serves as a reminder for WordPress site administrators to remain vigilant about plugin security. Regularly updating plugins, using reputable sources for extensions, and employing security monitoring tools can help protect websites from exploitation. The variety of vulnerabilities across different plugin types indicates a need for continuous security improvements from developers and heightened awareness from users.