What you need to know today.
Critical vulnerabilities found in TOZED X300 firmware, Wukong_HRM, and numerous WordPress plugins and themes.
A critical command injection vulnerability in the TOZED X300 firmware (up to 6.01.3) allows unauthenticated attackers to execute arbitrary OS commands by manipulating the 'Host' argument in the IPPingDiagnostics Handler's process_ping function. This could lead to full system compromise. CVE-2026-108576.
Multiple WordPress plugins are affected by critical vulnerabilities. SiteVault – Backup, Restore, Migration & Cloning (<= 1.5.19) suffers from unauthenticated RCE (CVE-2026-42696). The AI Content Generator Marketing plugin (<= 1.0.0) allows unauthenticated users to update and delete arbitrary WordPress options via AJAX actions (CVE-2026-85118). Freeton WP (<= 1.0.0) has an authentication bypass flaw enabling unauthenticated users to log in as any user, including administrators, by knowing their email address (CVE-2026-84737). Mindstien Quick Login (<= 1.0) allows unauthenticated attackers to obtain a valid user session by manipulating requests (CVE-2026-84734). Several click5 CRM add-ons for Contact Form 7 (<= 1.0.4), Gravity Forms (<= 1.0.3), WPForms (<= 1.0.3), and Ninja Forms (<= 1.0.1) lack authorization and CSRF checks on REST endpoints for updating options, potentially allowing unauthorized modifications (CVE-2026-84254, CVE-2026-84253, CVE-2026-84252, CVE-2026-84251). The Anton Extensions plugin (<= 1.2.2) has a critical file write vulnerability due to insufficient validation, allowing unauthenticated attackers to write content to arbitrary paths (CVE-2026-104028).
A significant number of WordPress themes are vulnerable to unauthenticated PHP Object Injection attacks. These include Buzz Stone | Magazine & Viral Blog Theme (<= 1.0.2) (CVE-2026-81797), Photolia (<= 1.0.3) (CVE-2026-78535), Qwery (<= 3.6.1) (CVE-2026-78533), Jacqueline (<= 2.22) (CVE-2026-78531), Alliance (<= 3.11) (CVE-2026-78529), Kicker (<= 2.2.1) (CVE-2026-66569), Original (<= 1.9.0) (CVE-2026-66568), Anesta (<= 1.5.3) (CVE-2026-66567), and FC United (<= 1.1.1) (CVE-2026-66565). These flaws could allow attackers to execute arbitrary code or disrupt site functionality.
Wukong_HRM, up to commit 186115e, contains an authentication bypass vulnerability in its ParamAspect. By omitting the AUTH-TOKEN header, unauthenticated attackers can access all HRM API endpoints, gaining HR administrator privileges. This allows for potential data manipulation or unauthorized access to sensitive HR information. CVE-2026-108707.