What you need to know today.
Critical flaws in WordPress plugins, Joomla extensions, and the `justhtml` library allow unauthenticated RCE and admin access, while Linux kernel fixes address various vulnerabilities.
Multiple critical vulnerabilities have been disclosed in WordPress plugins, with three specific plugins allowing for unauthenticated attackers to gain administrative access. The SmilePass Selfie Login plugin (through v1.0.2), the Social Login & Sharing buttons with Analytics By SoClever plugin (through v1.2.0), and the WP Social Media Login plugin (through v1.0.6) all suffer from a lack of proper server-side verification or authentication checks. This allows attackers to bypass login procedures and assume the identity of any user, including administrators, potentially leading to complete site compromise. As Vypr Intelligence reported, these flaws pose a significant risk to WordPress users.
The Fabrikar Joomla Extension, specifically versions prior to 4.7.2, is affected by a critical missing Access Control List (ACL) check in its download element, identified as CVE-2026-76607. This vulnerability, along with a path traversal flaw in the image element (CVE-2026-76606) and an unauthenticated remote code execution vulnerability via its PHP form element (CVE-2026-76604), allows for significant compromise. A further remote code execution vulnerability exists in the image element (CVE-2026-76605). These combined issues could allow attackers to download sensitive files, traverse directories, and execute arbitrary code on the server, leading to a full system takeover.
A series of critical vulnerabilities have been identified in the justhtml library, affecting versions up to 1.12.0, 1.15.0, and 1.16.0 depending on the specific issue. CVE-2026-8445, CVE-2026-7808, and CVE-2026-5388 detail flaws in HTML sanitization, URL sanitization, and Markdown conversion. These vulnerabilities can lead to the bypass of security measures, allowing for the injection of active or dangerous content such as scripts, potentially resulting in cross-site scripting (XSS) attacks. The insufficient escaping of HTML characters in text nodes during Markdown conversion also presents a risk.
Critical privilege escalation vulnerabilities have been disclosed in the StackGres operator (CVE-2026-78155) and the Comfast CF-N1-S router firmware (CVE-2026-78050). In StackGres, a low-privilege tenant with database ownership can escalate to administrator privileges. For the Comfast router, a vulnerability in the Web Management component's handling of NTP timezone arguments allows for manipulation, potentially leading to unauthorized access or control.
Several critical vulnerabilities have been addressed in the Linux kernel, including issues related to VXLAN header pulls (CVE-2026-74474), socket queue dumps in tipc (CVE-2026-72299), NTFS3 buffer validation (CVE-2026-72191), SCSI target transport ID parsing (CVE-2026-72084), RCU protection in rt_spin_unlock (CVE-2026-72069), packet length validation in the mana driver (CVE-2026-72065), partial send handling in espintcp (CVE-2026-72041), and bounds checking for libceph PG sizes (CVE-2026-68159). These fixes address potential memory corruption, denial-of-service, and information disclosure risks within the kernel.