WordPress Plugins: 25 Vulnerabilities Disclosed in Single-Day Batch, Affecting Multiple Core Functions
Key findings • 25 WordPress plugin vulnerabilities disclosed on August 10, 2026, spanning multiple plugins. • Critical and high-severity flaws include SQL injection, RCE, arbitrary file delet…
Key findings
- 25 WordPress plugin vulnerabilities disclosed on August 10, 2026, spanning multiple plugins.
- Critical and high-severity flaws include SQL injection, RCE, arbitrary file deletion, and information disclosure.
- Vulnerabilities affect plugins like Sucuri Security, ProSolution WP Client, File Manager, and Salon Booking System.
- Many flaws allow unauthenticated access or privilege escalation due to insufficient authorization checks.
- Patches are available for most affected plugins; immediate updates are recommended.
On August 10, 2026, a significant batch of 25 vulnerabilities was disclosed across various WordPress plugins, with a tight disclosure window of just 14 hours. These vulnerabilities, ranging in severity from medium to critical, expose a wide array of potential attack vectors, including arbitrary file deletion, remote code execution, SQL injection, and sensitive information exposure. The sheer volume and diversity of these flaws highlight ongoing security challenges within the extensive WordPress plugin ecosystem.
Several plugins were found to have critical or high-severity vulnerabilities. CVE-2026-19053, a critical blind SQL injection flaw in the ProSolution WP Client plugin (versions prior to 2.0.6), allows unauthenticated visitors to extract sensitive database information. Similarly, CVE-2026-18470, CVE-2026-17542, and CVE-2026-17541, all rated high severity, affect plugins like Login & Register Forms and File Manager, enabling unauthenticated users to obtain registered users' email addresses, download arbitrary files, or access file activity logs.
Other notable vulnerabilities include path traversal in the Sucuri Security plugin (CVE-2026-73033), allowing authenticated administrators to delete arbitrary files. The Product Input Fields for WooCommerce plugin (prior to 2.0.2) suffers from a vulnerability (CVE-2026-19089) that permits unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. The Duplicate Post plugin (prior to 1.5.5) has a flaw (CVE-2026-19077) that allows any user with plugin access to delete arbitrary posts.
Several plugins were found to have issues related to authentication and authorization checks. The ProSolution WP Client plugin (CVE-2026-19049) allows unauthenticated users to read arbitrary data from the database due to improper cookie sanitization. The Block User Account plugin (CVE-2026-18960) fails to enforce account blocking on all authentication paths, allowing users with application passwords to retain access. The File Manager plugin (CVE-2026-17540, CVE-2026-17542, CVE-2026-17541) exhibits multiple authorization bypasses, allowing authenticated users to browse and download files, and unauthenticated users to read file activity logs. The Salon Booking System plugin (CVE-2026-17023, CVE-2026-17022, CVE-2026-17020, CVE-2026-17021) has several vulnerabilities related to improper validation of booking ownership and OAuth state, enabling unauthenticated access to customer data and modification of booking details.
The majority of these vulnerabilities appear to have been addressed in plugin updates released around the disclosure date. For instance, ProSolution WP Client was updated to 2.0.6 and 2.0.9, Sucuri Security to 2.7.4, Product Input Fields for WooCommerce to 2.0.2, Duplicate Post to 1.5.5, and File Manager to 6.9.1. Users are strongly advised to update all affected plugins to their latest versions to mitigate these security risks.
This coordinated disclosure event underscores the critical importance of regular security audits and timely patching for all WordPress plugins. The breadth of affected plugins and the severity of the disclosed vulnerabilities highlight a persistent need for developers to prioritize secure coding practices and for site administrators to maintain vigilant update schedules. Staying informed about such disclosure batches and applying patches promptly is essential for protecting WordPress sites from compromise.