What you need to know today.
Critical vulnerabilities in Adobe Campaign Classic, Wavlink devices, and WordPress plugin expose users to code execution and command injection risks.
Adobe Campaign Classic (ACC) is facing a barrage of critical vulnerabilities, including SQL injection, OS command injection, and code injection flaws. These issues, detailed in CVE-2026-105781, CVE-2026-104353, CVE-2026-105780, and CVE-2026-104351, could allow low-privileged attackers to achieve arbitrary code execution within the user context. The widespread impact on ACC, a platform used for customer relationship management and marketing automation, makes these vulnerabilities a significant concern for organizations relying on it for sensitive data handling and communication.
Several Wavlink devices, including the WN536AX6-A, WN553X1-B, WN701AE, and WL-WN530HG4B, are affected by command injection vulnerabilities. These flaws, such as CVE-2026-120282, CVE-2026-120239, CVE-2026-120231, CVE-2026-120227, and CVE-2026-120197, allow remote attackers to execute arbitrary commands by manipulating specific arguments in network-related functions. The potential for command injection on these networking devices could lead to unauthorized access, network compromise, and further exploitation.
The CryptoPayment Gateway WordPress plugin, versions 1.2.1 to 1.2.2, has a critical authorization bypass vulnerability (CVE-2026-81648) that allows unauthenticated users to perform administrative operations, including deleting arbitrary files. This flaw, highlighted by The Hacker News and Wordfence, could lead to data loss, site defacement, or complete system compromise. The ease of exploitation and the sensitive nature of cryptocurrency transactions make this a high-priority issue for WordPress users.