Daily briefing · August 31, 2026
WordPress Plugins and Tenda Routers Dominate a High-Alert Day With 41 Critical CVEs
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
August 31, 2026 closes with an ATTENTION-level verdict: while no new KEV entries were formally added, VulnCheck flagged CVE-2026-82970 as actively exploited before any CISA confirmation, underlining how real-world attacks outpace official advisories. The day produced 265 new vulnerabilities, 41 of them critical, with WordPress ecosystem components and Tenda home routers accounting for the bulk of the most dangerous disclosures. Defenders should treat several of these as operationally urgent given public proof-of-concept code and one confirmed pre-CISA exploitation signal.
Today’s brief
- CVE-2026-82970: CVSS 10.0 unrestricted file upload in WP Cookie Notice — already seen exploited by VulnCheck before CISA confirmation
- Three Tenda router CVEs (AC18, AC1206 ×2) carry CVSS 10.0 with public PoC exploits, all enabling unauthenticated remote access
- Two additional WordPress plugins (Newspapers X, Hash Form, WPLP Cookie Consent) expose unauthenticated arbitrary file upload at critical severity
- Dell PowerStore and MCPHub round out the critical list with authentication-bypass and remote code execution risks in enterprise environments
Critical highlights
1
CVE-2026-82970◆ VulnCheckCVSS 10affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent An unrestricted file upload flaw in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (through 4.4.1) scored a perfect CVSS 10.0 and was flagged by VulnCheck as exploited in the wild before CISA issued any advisory — making this the highest-urgency item of the day; unauthenticated attackers can plant malicious files directly on affected WordPress sites.
2
A publicly disclosed command injection flaw in QVidium Opera11 3.3.2a26-Ax4x-opera11 allows remote attackers to inject OS commands via the CGI ipaddr parameter; the vendor has ceased operations, meaning no official patch will ever be released and exposed devices should be isolated immediately.
3
Newspapers X (versions 1.0.46–1.0.48) contains an improper input quantity validation flaw that enables malicious software implantation, rated CVSS 10.0; WordPress sites running affected versions should be updated or deactivated without delay.
4
Hash Form versions up to 1.4.2 allow unauthenticated arbitrary file upload, a classic vector for web shell deployment and full site compromise; the CVSS 10.0 rating reflects the ease of exploitation requiring no credentials.
5
A missing authentication vulnerability in the Telnet Handler (/goform/telnet) of Tenda AC18 firmware 15.03.05.19 has a public exploit and CVSS 10.0, granting any remote attacker unauthenticated access to the device's administrative telnet interface.
6
The R7WebsSecurityHandler function in Tenda AC1206 firmware 15.03.06.23 lacks authentication on the /goform/ate endpoint; a public exploit is available, making unauthenticated remote takeover trivial for any attacker with network access.
7
A second CVSS 10.0 flaw in Tenda AC1206 15.03.06.23 affects the TendaTelnet function, again removing authentication from a telnet-enabling endpoint; with a public PoC in circulation, these routers should be considered fully compromised if internet-exposed.
8
MCPHub prior to 0.12.15 allows authenticated users to spawn arbitrary system processes via the server configuration API, effectively enabling remote code execution in environments orchestrating MCP servers; upgrade to 0.12.15 or restrict API access immediately.
9
Dell PowerStore contains a missing authentication vulnerability on its restricted management interface that could allow an unauthenticated network attacker to read internal filesystem data including credentials, potentially enabling full administrative control; no credentials required makes this particularly dangerous in poorly segmented storage networks.
10
CVE-2026-75865CVSS 9.8affects WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode The WPLP Cookie Consent plugin for WordPress (through 4.4.1) combines missing file type validation with an authorization bypass on REST endpoints, enabling unauthenticated arbitrary file uploads; the overlap in version range and plugin category with CVE-2026-82970 suggests coordinated researcher attention on the GDPR consent plugin space.
Ransomware today
Several Brazilian organizations have been claimed as ransomware victims in recent days, with groups including thegentlemen, emperador, ZaWoo, and unsafe posting them to leak sites. Among the victims are Exacta Optech Labcenter in the healthcare sector (claimed by thegentlemen), Uniguacu (claimed by emperador), frm.ind.br (ZaWoo), and amzur.com (unsafe). Over the past 30 days, thegentlemen leads activity in Brazil with six confirmed claims, followed by krybit with four, reinforcing a sustained targeting pattern against Brazilian organizations across multiple sectors.
Uniguacu BRemperador · Other
Exacta Optech Labcenter BRthegentlemen · Healthcare
frm.ind.br BRZaWoo · Other
amzur.com BRunsafe
thegentlemen 6krybit 4emperador 2dragonforce 2L Group 2direwolf 2
Active groups & APTs
Several threat actor groups are currently being tracked as active or recently updated, including dragonforce, fulcrumsec, handala, kazu, kelvinsecurity, and the Iranian-linked blackshadow. While no new confirmed victims are attributed to these actors in the current reporting window, their monitored status indicates continued operational readiness and potential staging activity. Defenders in sectors historically targeted by Iranian threat actors should treat blackshadow's presence on tracking lists as a standing alert.
Brazil focus
Brazil continues to face concentrated ransomware pressure, with eight distinct Brazilian organizations appearing as victims across healthcare, technology, manufacturing, retail, and other sectors over the past 30 days. Healthcare targets such as Exacta Optech Labcenter and www.neooftalmo.com.br — both claimed by krybit or thegentlemen — highlight a deliberate focus on sensitive-data industries. The volume and diversity of affected sectors suggest Brazilian organizations of all sizes remain active targets and should prioritize incident response readiness alongside vulnerability patching.
Exacta Optech Labcenterthegentlemen · Healthcare
Uniguacuemperador · Other
frm.ind.brZaWoo · Other
amzur.comunsafe
sysconth.comkrybit · Technology
vascara.comkrybit · Retail & E-Commerce
TEC Containerthegentlemen · Manufacturing
www.neooftalmo.com.brkrybit · Healthcare
Today’s recommendation: Organizations running WordPress should audit all installed plugins against today's critical file-upload CVEs and disable affected versions immediately; Tenda router administrators must isolate or replace devices running vulnerable AC18 and AC1206 firmware given the availability of public exploits and the absence of authentication requirements for attack.
Given the number of unauthenticated remote exploitation paths disclosed today, now is the right time to validate what your actual attack surface looks like from an external perspective — before an attacker does it for you.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →