What you need to know today.
Multiple critical vulnerabilities disclosed today impact WordPress plugins via compromised updates and other platforms, enabling RCE, data exfiltration, and privilege escalation.
A wave of critical vulnerabilities has been disclosed across multiple WordPress plugins, with several instances involving compromised update servers. The Premium SEO plugin (CVE-2026-14812) contains an unauthenticated backdoor enabling hidden administrator account creation and potentially RCE and SSRF. Similarly, the official MonsterInsights Pro update distribution channel was compromised, injecting malicious code into versions 10.2.2 and 10.2.0 (CVE-2026-11976). Multiple other WordPress plugins, including Type Hub (CVE-2026-66665), Spider Analyser (CVE-2026-65553), and several others (CVE-2026-65581, CVE-2026-65578, CVE-2026-65577, CVE-2026-65575, CVE-2026-65573, CVE-2026-65572, CVE-2026-65556, CVE-2026-65552), are affected by unauthenticated PHP Object Injection flaws. Additionally, the Betheme theme (CVE-2026-65548) suffers from contributor RCE, and the AIWU plugin (CVE-2026-65507) has an unauthenticated privilege escalation vulnerability. These widespread issues highlight the significant risk to WordPress sites from both plugin vulnerabilities and supply-chain attacks.
Critical vulnerabilities have also been reported in other software, including DataLinkDC, Qflksheep, and OpenReception. DataLinkDC's download handler (CVE-2026-70558) is susceptible to path traversal due to insufficient validation, allowing attackers to potentially access sensitive files. Qflksheep's FineAdmin V1.0 (CVE-2026-67689) and ICS-Park Smart Park Management System v2.0 (CVE-2026-67688) both contain critical vulnerabilities. The former allows SQL injection via specific parameters, while the latter has an unrestricted file upload vulnerability, both leading to arbitrary code execution. OpenReception's appointment booking software has two critical flaws: CVE-2026-48086 allows a tenant administrator to promote themselves to a global administrator, and CVE-2026-48085 enables unauthenticated creation of admin accounts via POST requests to the setup endpoint. These vulnerabilities underscore the diverse attack vectors and potential for significant compromise across various platforms.