Daily briefing · September 12, 2026
WordPress Plugin Blitz: Nine Critical RCE and Takeover Flaws Disclosed on a Quiet Exploit Day
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
September 12, 2026 registers as a calm day on the exploit-activity front — no vulnerabilities moved to active exploitation and none were weaponized ahead of public disclosure — yet the CVE queue tells a different story for WordPress site owners, with nine critical-severity plugin flaws published simultaneously, several enabling unauthenticated remote code execution or full site takeover. The absence of confirmed in-the-wild exploitation should not breed complacency: proof-of-concept code already exists for most of these issues, and the attack surface is vast given how widely these plugins are deployed. Defenders running WordPress environments should treat today's disclosures as high-priority patching tasks, not background noise.
Today’s brief
- Nine critical WordPress plugin CVEs disclosed today — multiple allow unauthenticated RCE or complete site takeover
- CVE-2026-78006 (The Events Calendar) was weaponized the same day it was disclosed — fastest armament window in today's batch
- Brazil is under sustained ransomware pressure: nightspire, lockbit5, and Vexy Ransomware all claimed Brazilian victims recently across manufacturing, healthcare, and technology sectors
- No KEV additions and zero in-the-wild exploits confirmed today, but PoC availability keeps risk elevated for unpatched sites
Critical highlights
1
A PHP object injection flaw in Masteriyo LMS (before 3.4.1) lets any authenticated user — even one with a minimal account — deserialize attacker-controlled metadata and leverage a bundled library gadget chain to write and execute arbitrary code on the server; the low privilege bar makes this especially dangerous on multi-tenant or open-registration sites.
2
Remote code execution in The Events Calendar plugin (up to 6.17.4) via a bypass of the is_safe_widget_instance integrity check, exploiting PHP magic-method firing during pre-parse; notably, a working exploit was available the same day the CVE was published, compressing the patching window to near zero for exposed sites.
3
A second RCE path in The Events Calendar (up to 6.17.3) abuses insufficient validation of the widget 'classes' map, allowing a plain-array payload to skip the object-safety check and reach the callable-invocation sink in Element_Classes::parse_array() — sites running either vulnerable version should patch immediately as two independent attack vectors now exist.
4
The DS Ad Rotator plugin (through 0.8) exposes an image upload handler with no authentication, no nonce, and no file-type restriction, allowing any unauthenticated visitor to upload a PHP webshell to a publicly accessible directory and execute arbitrary commands on the server.
5
Frontegg SAML SSO (through 1.0.1) skips signature and issuer verification on SAML authentication responses, meaning an unauthenticated attacker can forge a response to log in as any existing user — including administrators — or create arbitrary new accounts, effectively handing over full site control.
6
WP images upload on piclect (through 1.0) writes uploaded files to a public directory without validating name or type, enabling unauthenticated arbitrary file upload leading directly to server-side code execution — a textbook unrestricted upload vulnerability with no mitigating controls in place.
7
WP Component (through 2.2.4) exposes an unauthenticated action that accepts arbitrary option names and values from the request, allowing attackers to overwrite core WordPress options such as enabling open registration and assigning administrator roles to new accounts — a reliable full-site takeover primitive.
8
CODE MONKEYS PROPOSALS (through 1.0.1) lets any authenticated user — subscriber-level is sufficient — supply an arbitrary file path to a deletion endpoint with no capability check, enabling targeted destruction of critical server files such as wp-config.php and facilitating a complete site takeover.
9
WebTotem Backups (through 1.0.1) shares the same arbitrary file deletion pattern as CVE-2026-77005 but adds a particularly egregious detail: the plugin performs a CSRF check and then discards the result, meaning the protection is entirely illusory and any authenticated user can delete files freely.
10
sngrep (through 1.8.4) contains stack buffer overflows triggered by SIP packets with oversized header fields such as Call-ID or X-Call-ID exceeding 255 bytes; an attacker with network access capable of injecting crafted SIP traffic could cause crashes or achieve arbitrary code execution in environments using sngrep for real-time SIP monitoring.
Ransomware today
Several Brazilian organizations have been claimed as ransomware victims in recent days across critical sectors: Tuboaços da Amazônia Ltda. (manufacturing) was listed by nightspire, amorsaude.com.br (healthcare) appeared on the lockbit5 leak site, and Logar Network Solutions (technology) was claimed by Vexy Ransomware. Among the most active groups over the past 30 days, thegentlemen stands out with nine known victims — all in Brazil — reinforcing that Brazilian targets are being actively prioritized rather than incidentally hit.
Tuboaços da Amazônia Ltda. BRnightspire · Manufacturing
amorsaude.com.br BRlockbit5 · Healthcare
Logar Network Solutions BRVexy Ransomware · Technology
thegentlemen 9krybit 3direwolf 2dragonforce 2emperador 2Vexy Ransomware 2
Active groups & APTs
Several threat groups are being tracked as active or recently updated in intelligence feeds, including dragonforce, fulcrumsec, funksec, linkc, spacebears, and the Iranian-attributed blackshadow. While no specific new victims are attributed to these actors in the current reporting window, their presence in active tracking indicates ongoing operational readiness and warrants monitoring, particularly for organizations in sectors historically targeted by Iranian-nexus groups.
Brazil focus
Brazil is experiencing a concentrated wave of ransomware attention: in addition to the three victims claimed in recent days (Tuboaços da Amazônia, amorsaude.com.br, and Logar Network Solutions), the past 30 days have seen further claims against Zanini, Biotipo Jeans, Mutant, Alurwalls, and Lider Aviacao — spanning manufacturing, retail, transportation, and other sectors. The dominance of thegentlemen across Brazilian victims, combined with the presence of lockbit5 and new entrants like Vexy Ransomware, signals that Brazil remains a high-value target environment with multiple concurrent threat actors competing for access.
Tuboaços da Amazônia Ltda.nightspire · Manufacturing
amorsaude.com.brlockbit5 · Healthcare
Logar Network SolutionsVexy Ransomware · Technology
Zaninithegentlemen · Manufacturing
Biotipo Jeansthegentlemen · Retail & E-Commerce
Mutantthegentlemen · Other
AlurwallsDark Project · Manufacturing
Lider Aviacaothegentlemen · Transportation
Today’s recommendation: WordPress administrators should audit all installed plugins against today's CVE list and apply available patches immediately, prioritizing The Events Calendar given its same-day weaponization; sites running DS Ad Rotator, WP Component, or Frontegg SAML SSO with no patch yet available should consider disabling the plugin until a fix is released. Organizations running sngrep in production SIP monitoring environments should restrict network access to the tool and monitor for an upstream patch.
With multiple unauthenticated RCE and file-upload vectors disclosed today alongside sustained ransomware pressure on Brazilian organizations, now is the right moment to validate which of these vulnerable components exist across your own infrastructure before attackers do it for you.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →