Daily briefing · September 4, 2026
WordPress Plugins and FreeIPMI Lead a Calm but Patch-Heavy Day
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
September 4, 2026 registers as a calm day in terms of active exploitation — no vulnerabilities were weaponized, no KEV additions, and no VulnCheck early signals — but the volume of critical disclosures remains notable, with 37 critical CVEs among 506 newly published. The day's highlights cluster around unauthenticated attack vectors in WordPress plugins and a batch of stack-based buffer overflows in FreeIPMI, all carrying CVSS 9.8 scores that demand prompt patching attention. Defenders should not let the absence of active exploitation translate into complacency: several of these flaws already have proof-of-concept code available.
Today’s brief
- No active exploitation or KEV additions recorded today — veredito is CALM, but 37 critical CVEs were disclosed
- WordPress plugins dominate: unauthenticated RCE, LFI, and privilege escalation flaws affect AI Website Builder, Divi Ajax Filter, and ACPT Premium
- FreeIPMI ships five stack-based buffer overflows (CVE-2026-85509, -85508, -85507, -85506, -85504) all rated CVSS 9.8 — patch to 1.6.19 immediately
- Brazil faces intensifying ransomware pressure: four new victims across manufacturing, healthcare, and other sectors identified in recent days
Critical highlights
1
The AI Website Builder WordPress plugin (GitHub build) 1.0.0 exposes unauthenticated REST API routes allowing attackers to install arbitrary plugins/themes, import remote content, write files to the uploads directory, and delete site media — on PHP-enabled hosts, this effectively means unauthenticated remote code execution. A proof of concept is already available, raising the urgency for any site running this build.
2
The Divi Ajax Filter plugin (all versions through 5.1.2) is vulnerable to unauthenticated Local File Inclusion via the 'custom_loop_template' parameter, enabling execution of arbitrary PHP files on the server. Critically, this flaw was weaponized on the same day it was disclosed, meaning exploit code reached attackers before most defenders could act — treat this as an emergency patch.
3
FreeIPMI before 1.6.19 contains a stack-based buffer overflow in _read_fru_data triggered when a BMC returns more bytes than requested, allowing a malicious or compromised BMC to crash or potentially execute code in the context of the IPMI management utilities. All five FreeIPMI CVEs share the same fix target (1.6.19) and affect out-of-band server management infrastructure.
4
The ipmi-oem tool in FreeIPMI before 1.6.19 overflows a stack buffer when processing Dell CMC IPv6 information responses, a vector reachable if an attacker controls or spoofs the BMC reply. Combined with the other FreeIPMI flaws disclosed today, this represents a significant attack surface for data-center management networks.
5
Another stack-based buffer overflow in ipmi-oem's Dell CMC info subcommand (FreeIPMI < 1.6.19); exploitation requires interaction with a malicious or attacker-controlled BMC endpoint but can result in process memory corruption and potential code execution in privileged management contexts.
6
FreeIPMI's ipmi-oem is also vulnerable via the Dell idrac-info subcommand, where _get_dell_system_info_idrac_info overflows a stack buffer on crafted iDRAC responses. Organizations running Dell server fleets with FreeIPMI tooling should prioritize upgrading to 1.6.19 across all four Dell-specific buffer overflow CVEs.
7
A fifth FreeIPMI buffer overflow, this one in the SEL parsing code for Fujitsu iRMC systems, triggers on malformed Fujitsu SEL long-text responses — expanding the affected hardware scope beyond Dell to Fujitsu environments. Patch to FreeIPMI 1.6.19 resolves all five stack overflow issues disclosed today.
8
The ACPT Premium WordPress plugin (through 2.0.66) allows unauthenticated attackers to overwrite any WordPress user's email address — including administrator accounts — via missing authorization in a form submission function, enabling full account takeover. This privilege escalation path requires no credentials and no user interaction beyond submitting a crafted request.
9
IBM Operational Decision Manager across multiple versions (8.x and 9.x) is vulnerable to unauthenticated SQL injection that can be chained to write a web shell to the application root, yielding remote code execution. IBM ODM is commonly deployed in enterprise business-rules automation environments, and an unauthenticated RCE path in such a system represents a critical risk to sensitive business logic and data.
10
The Canva Android app before version 2.376.0 permitted an external origin to load within a privileged WebView, allowing a threat actor controlling the loaded page to communicate with Canva using the victim's authenticated session — effectively hijacking the user's Canva account via a malicious link. Users should ensure the app is updated to 2.376.0 or later.
Ransomware today
Four new ransomware victims tied to Brazil have been identified recently: Engefitas (manufacturing) was hit by Vexy Ransomware, ialegre.com (other sector) by settra, Oportunidados by direwolf, and paipharma.com (healthcare) by BrainCipher. Among the most active groups over the past 30 days, thegentlemen leads with six attacks, all in Brazil, followed by direwolf, krybit, and emperor — a pattern that underscores a sustained and geographically focused ransomware campaign against Brazilian organizations.
Engefitas BRVexy Ransomware · Manufacturing
ialegre.com BRsettra · Other
Oportunidados BRdirewolf
paipharma.com BRBrainCipher · Healthcare
thegentlemen 6direwolf 3krybit 3emperador 2dragonforce 2L Group 2
Active groups & APTs
Several threat actor groups are being tracked as recently active or updated, including dragonforce, fulcrumsec, handala, kazu, kelvinsecurity, and the Iranian-linked blackshadow, though no confirmed victims are currently attributed to these actors in the latest data. Their presence in threat intelligence feeds signals continued reconnaissance or preparation activity that defenders — especially in sectors targeted by Iranian or hacktivism-aligned groups — should monitor closely.
Brazil focus
Brazil continues to draw disproportionate ransomware attention, with eight Brazilian victims recorded in recent weeks spanning manufacturing, healthcare, and other sectors — including Engefitas (Vexy Ransomware), paipharma.com (BrainCipher), Exacta Optech Labcenter (thegentlemen), and Uniguacu (emperador), among others. The concentration of attacks from groups like thegentlemen and direwolf, nearly all targeting Brazilian entities exclusively, suggests coordinated campaigns rather than opportunistic targeting, warranting heightened defensive posture for organizations operating in Brazil.
EngefitasVexy Ransomware · Manufacturing
ialegre.comsettra · Other
Oportunidadosdirewolf
paipharma.comBrainCipher · Healthcare
frm.ind.brZaWoo · Other
Exacta Optech Labcenterthegentlemen · Healthcare
Uniguacuemperador · Other
amzur.comunsafe
Today’s recommendation: Prioritize patching FreeIPMI to version 1.6.19 to resolve all five stack buffer overflow CVEs, and immediately update or disable the Divi Ajax Filter plugin given its same-day weaponization. WordPress administrators should audit installed plugins against today's advisories, and IBM ODM operators should treat CVE-2026-18658 as a critical emergency given its unauthenticated RCE potential.
Even on a day without confirmed active exploitation, today's disclosures are a reminder that the gap between 'proof of concept published' and 'attacks in the wild' can close within hours — validating your own exposure to these asset classes before threat actors do is the most effective defensive move you can make.Before an attacker finds it, find it first: run a free initial exposure assessment and see whether your infrastructure is vulnerable to flaws like these.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →