Daily briefing · September 12, 2026
WordPress Plugin Blitz: Nine Critical RCE and Takeover Flaws Disclosed on a Quiet Exploit Day
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
September 12, 2026 registers as a calm day on the exploit-activity front — no vulnerabilities moved to active exploitation and none were weaponized ahead of public disclosure — yet the CVE queue tells a different story for WordPress site owners, with nine critical-severity plugin flaws published simultaneously, several enabling unauthenticated remote code execution or full site takeover. The absence of confirmed in-the-wild exploitation should not breed complacency: proof-of-concept code already exists for most of these issues, and the attack surface is vast given how widely these plugins are deployed. Defenders running WordPress environments should treat today's disclosures as high-priority patching tasks, not background noise.
Today’s brief
- Nine critical WordPress plugin CVEs disclosed today — multiple allow unauthenticated RCE or complete site takeover
- CVE-2026-78006 (The Events Calendar) was weaponized the same day it was disclosed — fastest armament window in today's batch
- Brazil is under sustained ransomware pressure: nightspire, lockbit5, and Vexy Ransomware all claimed Brazilian victims recently across manufacturing, healthcare, and technology sectors
- No KEV additions and zero in-the-wild exploits confirmed today, but PoC availability keeps risk elevated for unpatched sites
Critical highlights
1
A PHP object injection flaw in Masteriyo LMS (before 3.4.1) lets any authenticated user — even one with a minimal account — deserialize attacker-controlled metadata and leverage a bundled library gadget chain to write and execute arbitrary code on the server; the low privilege bar makes this especially dangerous on multi-tenant or open-registration sites.
2
Remote code execution in The Events Calendar plugin (up to 6.17.4) via a bypass of the is_safe_widget_instance integrity check, exploiting PHP magic-method firing during pre-parse; notably, a working exploit was available the same day the CVE was published, compressing the patching window to near zero for exposed sites.
3
A second RCE path in The Events Calendar (up to 6.17.3) abuses insufficient validation of the widget 'classes' map, allowing a plain-array payload to skip the object-safety check and reach the callable-invocation sink in Element_Classes::parse_array() — sites running either vulnerable version should patch immediately as two independent attack vectors now exist.
4
The DS Ad Rotator plugin (through 0.8) exposes an image upload handler with no authentication, no nonce, and no file-type restriction, allowing any unauthenticated visitor to upload a PHP webshell to a publicly accessible directory and execute arbitrary commands on the server.
5
Frontegg SAML SSO (through 1.0.1) skips signature and issuer verification on SAML authentication responses, meaning an unauthenticated attacker can forge a response to log in as any existing user — including administrators — or create arbitrary new accounts, effectively handing over full site control.
6
WP images upload on piclect (through 1.0) writes uploaded files to a public directory without validating name or type, enabling unauthenticated arbitrary file upload leading directly to server-side code execution — a textbook unrestricted upload vulnerability with no mitigating controls in place.
7
WP Component (through 2.2.4) exposes an unauthenticated action that accepts arbitrary option names and values from the request, allowing attackers to overwrite core WordPress options such as enabling open registration and assigning administrator roles to new accounts — a reliable full-site takeover primitive.
8
CODE MONKEYS PROPOSALS (through 1.0.1) lets any authenticated user — subscriber-level is sufficient — supply an arbitrary file path to a deletion endpoint with no capability check, enabling targeted destruction of critical server files such as wp-config.php and facilitating a complete site takeover.
9
WebTotem Backups (through 1.0.1) shares the same arbitrary file deletion pattern as CVE-2026-77005 but adds a particularly egregious detail: the plugin performs a CSRF check and then discards the result, meaning the protection is entirely illusory and any authenticated user can delete files freely.
10
sngrep (through 1.8.4) contains stack buffer overflows triggered by SIP packets with oversized header fields such as Call-ID or X-Call-ID exceeding 255 bytes; an attacker with network access capable of injecting crafted SIP traffic could cause crashes or achieve arbitrary code execution in environments using sngrep for real-time SIP monitoring.
Ransomware today
Several Brazilian organizations have been claimed as ransomware victims in recent days across critical sectors: Tuboaços da Amazônia Ltda. (manufacturing) was listed by nightspire, amorsaude.com.br (healthcare) appeared on the lockbit5 leak site, and Logar Network Solutions (technology) was claimed by Vexy Ransomware. Among the most active groups over the past 30 days, thegentlemen stands out with nine known victims — all in Brazil — reinforcing that Brazilian targets are being actively prioritized rather than incidentally hit.
Tuboaços da Amazônia Ltda. BRnightspire · Manufacturing
amorsaude.com.br BRlockbit5 · Healthcare
Logar Network Solutions BRVexy Ransomware · Technology
thegentlemen 9krybit 3direwolf 2dragonforce 2emperador 2Vexy Ransomware 2
Active groups & APTs
Several threat groups are being tracked as active or recently updated in intelligence feeds, including dragonforce, fulcrumsec, funksec, linkc, spacebears, and the Iranian-attributed blackshadow. While no specific new victims are attributed to these actors in the current reporting window, their presence in active tracking indicates ongoing operational readiness and warrants monitoring, particularly for organizations in sectors historically targeted by Iranian-nexus groups.
Brazil focus
Brazil is experiencing a concentrated wave of ransomware attention: in addition to the three victims claimed in recent days (Tuboaços da Amazônia, amorsaude.com.br, and Logar Network Solutions), the past 30 days have seen further claims against Zanini, Biotipo Jeans, Mutant, Alurwalls, and Lider Aviacao — spanning manufacturing, retail, transportation, and other sectors. The dominance of thegentlemen across Brazilian victims, combined with the presence of lockbit5 and new entrants like Vexy Ransomware, signals that Brazil remains a high-value target environment with multiple concurrent threat actors competing for access.
Tuboaços da Amazônia Ltda.nightspire · Manufacturing
amorsaude.com.brlockbit5 · Healthcare
Logar Network SolutionsVexy Ransomware · Technology
Zaninithegentlemen · Manufacturing
Biotipo Jeansthegentlemen · Retail & E-Commerce
Mutantthegentlemen · Other
AlurwallsDark Project · Manufacturing
Lider Aviacaothegentlemen · Transportation
Today’s recommendation: WordPress administrators should audit all installed plugins against today's CVE list and apply available patches immediately, prioritizing The Events Calendar given its same-day weaponization; sites running DS Ad Rotator, WP Component, or Frontegg SAML SSO with no patch yet available should consider disabling the plugin until a fix is released. Organizations running sngrep in production SIP monitoring environments should restrict network access to the tool and monitor for an upstream patch.
With multiple unauthenticated RCE and file-upload vectors disclosed today alongside sustained ransomware pressure on Brazilian organizations, now is the right moment to validate which of these vulnerable components exist across your own infrastructure before attackers do it for you.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
September 20, 2026 — Dozens of Critical PoC Flaws Surface in Routers and Research Tools, But No Active Exploitation DetectedSeptember 19, 2026 — Calm Vulnerability Day Masks Serious Flaws in Routers, WordPress, and SuricataSeptember 18, 2026 — WordPress, IBM, and vm2 Flaws Anchor a High-Alert Day With 5 CVEs Already Under Active ExploitationSeptember 17, 2026 — Six CVSS 10.0 Azure Flaws Lead a Heavy Patch Day as Acronis Backup Plugin Faces Active ExploitationSeptember 16, 2026 — Cisco Infrastructure Flooded With CVSS 10 Flaws as VulnCheck Spots Active Exploitation Before CISASeptember 15, 2026 — Oracle Patch Tuesday Surge and Yonyou Active Exploitation Drive ATTENTION-Level AlertSeptember 14, 2026 — Cisco Secure Email Under Active Exploitation as 58 Critical CVEs SurfaceSeptember 13, 2026 — WordPress Plugin Flaw Leads Quiet Day With 8 Critical CVEs and No Active ExploitationSeptember 12, 2026 — WordPress Plugin Blitz: Nine Critical RCE and Takeover Flaws Disclosed on a Quiet Exploit DaySeptember 11, 2026 — GitLab Critical Zero-Day Under Active Exploitation Leads a Heavy Patch Day with 36 Critical CVEsSeptember 10, 2026 — Ten Critical CVEs Published on a Calm Threat Day as Brazil Faces Ransomware SurgeSeptember 9, 2026 — Three CVEs Already Exploited Before CISA Confirmation, Dual Check Point RCE and cPanel SQLi-to-Root Round Out a High-Alert DaySeptember 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on Brazilview full archive →