Daily briefing · October 31, 2026
WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA Confirmation
Verdict of the day — attention4 seen before CISA
Today's verdict is ATTENTION: no vulnerability has reached weaponized status, but four were observed by VulnCheck as exploited ahead of any CISA confirmation, including a flaw in WordPress Core itself. Of the 123 new CVEs published, 11 are critical, and the ecosystem of WordPress plugins dominates the highlights with authentication bypasses and remote code execution. Outside WordPress, a CVSS 10.0 D-Link router flaw with a public proof of concept and unauthenticated RCE bugs in AJ-Report and Jpom also deserve attention.
Today’s brief
- Four CVEs (CVE-2026-116512, CVE-2026-119096, CVE-2026-119977, CVE-2026-103898) were seen exploited by VulnCheck before the CISA.
- CVE-2026-119977 affects WordPress Core 4.7 through 7.1.3 and allows unauthenticated code execution during the upgrade window.
- Several WordPress plugins combine critical severity with RCE, authentication bypass or arbitrary file upload.
- Unauthenticated RCE in AJ-Report and Jpom, plus a public PoC for the D-Link DIR-505 (CVSS 10.0), widen the exposure beyond WordPress.
11
critical
4
Actively exploited
4
Before CISA
0
Weaponized
Critical highlights
1
CVE-2026-116512◆ VulnCheckCVSS 9.8affects Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
Remote code execution (CVSS 9.8) in the Project Manager plugin up to 4.1.1, caused by an unsanitized 'id' parameter. Exploitation was observed by VulnCheck ahead of the CISA, so treat it as already in the wild and prioritize patching.
2
Authentication bypass (CVSS 9.8) in Uncanny Toolkit for LearnDash up to 3.8.2, through the email parameter of the login function. Exploitation was seen before the CISA, and a bypass like this can lead to account takeover, including privileged ones.
3
Remote code execution in WordPress Core (4.7 through 7.1.3) via predictable staging paths during full-package upgrades. Because it targets the core and was seen exploited early, it deserves immediate review of update procedures and patch status.
4
Authentication bypass in Wp Social Login and Register Social Counter up to 3.2.2: the REST callback is open and locates accounts solely by the email returned by the OAuth provider. Exploitation was observed before the CISA, putting existing accounts at risk of takeover.
5
Stack-based buffer overflow (CVSS 10.0) in the TFTP upload handler of the D-Link DIR-505 1.10B02, remotely reachable, with a public exploit at proof-of-concept level. Devices of this kind are often unpatched and exposed, so isolate or replace them.
6
CVE-2026-118235CVSS 9.8affects SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Arbitrary file upload (CVSS 9.8) in SimpleForm up to 3.10.2, where a trailing-dot filename bypasses extension and MIME validation. This typically opens the path to web shells and server compromise.
7
PHP Object Injection (CVSS 9.8) in PDF Invoice for WooCommerce up to 7.1.1, via the checkout customer_note field. Because that field is reachable by customers, the attack surface on online stores is wide.
8
Insecure deserialization without a class filter in the Apache MINA 3.0 codec, enabling gadget-chain RCE when exposed to untrusted peers. The 3.0.0 branch is inactive and will not be fixed, so the recommendation is to migrate to the 2.2 line.
9
AJ-Report through 1.7.1 uses a hard-coded JWT secret, allowing forged share tokens and unauthenticated RCE through the GroovyClassLoader. Hard-coded secrets make exploitation reproducible against any exposed instance.
10
Authentication bypass in Jpom 2.10.0 through 2.11.12 through query-condition injection in the token header, granting super-administrator access and command execution via script features. As a management tool, its compromise can give broad control over the environment.
Ransomware today
Punta Shopping (Retail & E-Commerce, Brazil) was recently listed as a victim of the emperador group. Over the last 30 days, the most active groups were N0n (6 victims, all in Brazil), emperador, qilin and thegentlemen (4 each, all in Brazil), followed by Eclipse and akira (2 each).
Punta Shopping BR
N0n 6emperador 4qilin 4thegentlemen 4Eclipse 2akira 2
Active groups & APTs
Several ransomware operations with a presence in Brazilian leak sites remain active: lockbit5 (54 Brazilian victims listed), thegentlemen and lockbit3 (39 each), ransomhub, of Russian origin (35), Akira (24) and arcusmedia (23). All are flagged as targeting Brazil.
lockbit5 mira BRthegentlemen mira BRlockbit3 mira BRransomhub mira BRAkira mira BRarcusmedia mira BR
Brazil focus
Recent Brazilian victims span several sectors: retail (Punta Shopping and Animart Pet Stores), healthcare (bio3g.com, CLIMEDI and Hospital Sírio-Libanês), manufacturing (P&B Textiles and GTL Concreto e Logística) and agribusiness (Pantanal Agricola). The groups involved include emperador, qilin, thegentlemen and THE SEVEN DEADLY SINS, with healthcare repeatedly in the crosshairs.
Punta Shopping
bio3g.com
P&B Textiles
Animart Pet Stores
GTL Concreto e Logística LTDA
CLIMEDI
Pantanal Agricola
Hospital Sírio-Libanês
Today’s recommendation: Immediately patch or disable the affected WordPress plugins and update WordPress Core, starting with the four CVEs seen exploited by VulnCheck, and review administrator accounts and recently uploaded files for signs of compromise. Take unsupported or exposed components (D-Link DIR-505, Apache MINA 3.0, Jpom, AJ-Report) off the internet or replace them.
With exploitation appearing before official confirmation, the only reliable way to know whether these risks affect you is to continuously test and validate your own attack surface.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →