Daily briefing · September 2, 2026
WordPress Plugins Under Fire, Cisco IOS XR and NX-OS in the Crosshairs: ATTENTION Day With Active Exploitation
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
September 2, 2026 demands defensive attention: 310 new CVEs were published, 21 classified as critical, with one vulnerability in active exploitation — CVE-2026-9055, affecting the Amelia WordPress plugin, flagged by VulnCheck before any CISA confirmation, and weaponized on the same day of disclosure. The day's highlight is a concentration of critical flaws across WordPress plugins and major Cisco infrastructure software, spanning privilege escalation, arbitrary file upload, unauthenticated remote code execution, and improper access control — all with proof-of-concept code already available.
Today’s brief
- CVE-2026-9055 (Amelia plugin): actively exploited, weaponized on day zero — patch or disable immediately.
- Two critical Cisco IOS XR flaws (CVE-2026-20279, CVE-2026-20274) and one Cisco NX-OS RCE (CVE-2026-20212) expose core network infrastructure to unauthenticated attackers.
- Multiple WordPress plugins carry unauthenticated file upload, arbitrary file deletion, and PHP code execution vulnerabilities — high exposure for shared hosting environments.
- Brazil is a top ransomware target this period: five new victims identified recently, including two in Healthcare, with thegentlemen, BrainCipher, and direwolf among the most active groups.
Critical highlights
1
CVE-2026-9055◆ VulnCheckCVSS 9.8PoCsame dayaffects Booking for Appointments and Events Calendar – Amelia Active exploitation confirmed by VulnCheck before CISA, with a proof-of-concept weaponized on the same day of disclosure — attackers can manipulate the 'type' parameter in the Amelia Premium plugin (versions 8.0–9.6.2) to escalate their role to manager-level, effectively hijacking site administration. Any WordPress site running this plugin should be treated as actively targeted until patched.
2
A CVSS 10.0 flaw in the Embed HTML5 Game WordPress plugin allows unauthenticated attackers to upload PHP backdoors directly to the server with no access controls in place — full remote code execution with zero authentication required. This is one of the most severe unauthenticated upload vulnerabilities disclosed this cycle.
3
The WatchMan-Site7 plugin exposes an unrestricted debugging console that executes arbitrary PHP code for any authenticated user, including low-privilege subscribers — effectively granting server-level code execution to anyone with a WordPress account. The risk is extreme on multi-user sites or membership platforms.
4
SigmaForms Pro allows unauthenticated attackers to delete arbitrary server files through the delete_submission_files function, a path that reliably leads to remote code execution when critical files such as configuration or index files are removed. All versions up to 1.4.11 are affected and there is no authentication barrier.
5
Under specific conditions in Secret Server (On-Prem), an attacker can register a malicious FIDO2 credential against a target account and authenticate as that user — effectively bypassing multi-factor authentication in an on-premises privileged access management solution. Organizations relying on Secret Server for privileged credential storage should treat this as a high-priority remediation.
6
Cisco internally discovered and disclosed improper access control vulnerabilities in IOS XR Software, scored CVSS 9.8, that could allow remote attackers to gain unauthorized access to affected routers — devices that sit at the core of carrier and enterprise networks. Cisco's proactive disclosure should not reduce urgency: patching core routing infrastructure is critical.
7
A companion critical flaw in Cisco IOS XR involves improper resource control, also scored CVSS 9.8, and similarly discovered through Cisco's internal security review. Its co-existence with CVE-2026-20279 means IOS XR operators may face compounded risk and should apply the hardening releases covering both issues simultaneously.
8
Cisco Nexus 9000 Series Switches are exposed to unauthenticated remote code execution with root privileges via TCP ports 43210 and 43211, accessible by default in the L3 VRF — an attacker on the network can connect and execute arbitrary commands as root. Data center operators running NX-OS with Silicon One integration should treat this as an emergency-level patch.
9
An OS command injection flaw in the Looking Glass network diagnostic platform (prior to 1.3.5) stems from an unanchored regular expression that fails to sanitize user input, allowing attackers to inject shell commands through the diagnostic interface. Network operations teams using this tool for BGP and routing diagnostics are directly exposed.
10
The Developer Tools WordPress plugin (through version 1.1.3) bundles a vulnerable SWFUpload component that permits unauthenticated arbitrary file upload — a classic attack vector that can lead directly to web shell deployment and full server compromise. The bundled legacy component significantly widens the attack surface.
Ransomware today
Ransomware activity remains intensive, with five Brazilian victims identified recently across multiple groups: direwolf claimed Oportunidados, BrainCipher targeted paipharma.com in the Healthcare sector, thegentlemen hit Exacta Optech Labcenter (Healthcare), emperador claimed Uniguacu, and ZaWoo listed frm.ind.br. Over the past 30 days, thegentlemen leads activity with six victims — all in Brazil — followed by krybit (four, all in Brazil) and direwolf (three, all in Brazil), indicating a sustained and geographically concentrated campaign against Brazilian organizations.
Oportunidados BRdirewolf
paipharma.com BRBrainCipher · Healthcare
Uniguacu BRemperador · Other
Exacta Optech Labcenter BRthegentlemen · Healthcare
frm.ind.br BRZaWoo · Other
thegentlemen 6krybit 4direwolf 3emperador 2dragonforce 2L Group 2
Active groups & APTs
Several threat actor groups are currently being tracked as active or recently updated, including dragonforce, fulcrumsec, handala, kazu, kelvinsecurity, and the Iran-linked blackshadow. While no new confirmed victims are attributed to these groups in the current window, their active monitoring status suggests operational readiness and potential forthcoming campaigns — defenders should watch for indicators associated with these actors, particularly blackshadow given its state-linked origins.
Brazil focus
Brazil continues to face disproportionate ransomware pressure over the past 30 days, with organizations in Healthcare proving to be a recurring target: paipharma.com (BrainCipher), Exacta Optech Labcenter (thegentlemen), and www.neooftalmo.com.br (krybit) were all recently claimed. Technology and unclassified sectors are also affected, with sysconth.com (krybit) and amzur.com (unsafe) among recent victims. The concentration of active groups operating almost exclusively within Brazil — thegentlemen, krybit, direwolf, and emperador — signals that Brazilian entities are being deliberately selected as primary targets.
Oportunidadosdirewolf
paipharma.comBrainCipher · Healthcare
Exacta Optech Labcenterthegentlemen · Healthcare
Uniguacuemperador · Other
frm.ind.brZaWoo · Other
amzur.comunsafe
sysconth.comkrybit · Technology
www.neooftalmo.com.brkrybit · Healthcare
Today’s recommendation: Prioritize immediate patching or disabling of affected WordPress plugins — especially Amelia Premium, Embed HTML5 Game, WatchMan-Site7, and SigmaForms Pro — as all carry unauthenticated or low-privilege exploitation paths with existing proof-of-concept code. Cisco network operators should apply IOS XR hardening releases and restrict or firewall TCP ports 43210 and 43211 on Nexus 9000 devices without delay.
With critical vulnerabilities spanning WordPress plugins, enterprise network infrastructure, and PAM solutions simultaneously, now is the moment to validate your own attack surface and confirm that exposure to these vectors is either patched, mitigated, or monitored.Don’t wait to become a statistic: validate today, at no cost, whether any of these vectors reach your systems.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →