Daily briefing · November 2, 2026
WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise access
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
The verdict for November 2 is ATTENTION: of the 392 new vulnerabilities, 21 were critical, and the top item, a remote code execution flaw in the s2Member WordPress plugin (CVE-2026-86596), was observed in exploitation by VulnCheck before any CISA confirmation and was weaponized on the day of disclosure. No flaw reached the 'weaponized' stage and the KEV catalog recorded no new entries that day, but the early signal on s2Member calls for prompt action. The rest of the list is dominated by critical file upload and deletion bugs in CMS extensions, command injection in WAVLINK routers, and authentication and access control failures in enterprise products.
Today’s brief
- CVE-2026-86596 (s2Member, CVSS 9.8): RCE flagged by VulnCheck before CISA, weaponized on the day of disclosure.
- Two WAVLINK WN551X3-A flaws (CVSS 10.0) allow remote OS command injection, with public PoCs.
- WordPress and Joomla plugins and extensions concentrate unauthenticated file upload and deletion bugs that can lead to RCE.
- Secure Access (two CVEs), WSO2 and Amazon VEW show access control and authentication failures in corporate environments.
Critical highlights
1
CVE-2026-86596◆ VulnCheckCVSS 9.8PoCsame dayaffects s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions RCE in the s2Member plugin for WordPress through the 'item_name' parameter, with exploitation seen by VulnCheck before CISA and a PoC available. Weaponized on the day of disclosure, a strong sign that attackers are prioritizing it; sites with this plugin should be treated as at risk.
2
OS command injection in the DNS resolution handler of the WAVLINK WN551X3-A, remotely exploitable and with a public exploit. CVSS 10.0 on an exposed network device can give full control of the equipment.
3
Another command injection (CVSS 10.0) in the WAVLINK WN551X3-A, this time in the WireGuard CLI group handler via the 'group_name' argument. A public exploit exists, and the vendor reportedly did not respond to the early contact.
4
Unauthenticated arbitrary file deletion in Ultra Addons for Contact Form 7 (up to 3.5.54). Deleting critical files such as wp-config.php can easily escalate to remote code execution and site takeover.
5
Unauthenticated arbitrary file upload in Custom Tables for Joomla (before 3.7.8) via a polyglot file placed in a web-accessible directory, with the path disclosed in the response. Sites with a public submission form are especially exposed.
6
CSRF in Secure Access 14.60 that bypasses a security control and can make an administrator create an attacker-controlled account. The result is persistent privileged access to a remote access product.
7
Arbitrary file upload in DJ-Classifieds for Joomla (before 3.11.3) that leads to full RCE, even for an unprivileged user. Any account on the site can be enough to compromise the server.
8
Template injection in the publishing component of Amazon Virtual Engineering Workbench, enabling code execution with the permissions of the publishing Lambda's IAM role. The impact could reach data and resources across all tenant projects.
9
Access control failure in the System REST APIs of WSO2 API Control Plane, letting lower-privilege users run administrative actions. This enables privilege escalation and unauthorized operations on the API management platform.
10
Authentication bypass in Secure Access servers (13.0 up to before 14.61) that lets attackers modify a client's security settings through the server. This weakens endpoint protections and can serve as a stepping stone for further attacks.
Ransomware today
Punta Shopping (Retail & E-Commerce, Brazil) was recently listed as a victim of the emperador group. Over the past 30 days, the most active groups include N0n (6 victims), thegentlemen, emperador and qilin (4 each), followed by Eclipse and incransom (2 each), all with activity concentrated in Brazil.
Punta Shopping BRemperador · Retail & E-Commerce
N0n 6thegentlemen 4emperador 4qilin 4Eclipse 2incransom 2
Active groups & APTs
Several groups with a Brazilian focus remain active: lockbit5 (54 Brazilian victims listed on leak sites), lockbit3 and thegentlemen (39 each), ransomhub, of Russian origin (35), Akira (24) and arcusmedia (23). The volume shows Brazil as a persistent target for ransomware operations.
Brazil focus
Recent Brazilian victims span several sectors: retail (Punta Shopping and Animart Pet Stores), healthcare (bio3g.com and Hospital Sírio-Libanês), manufacturing (P&B Textiles and GTL Concreto e Logística), education (Universidade de Passo Fundo) and agribusiness (Pantanal Agricola). The groups involved include emperador, qilin, thegentlemen and THE SEVEN DEADLY SINS, with qilin and thegentlemen standing out in the recent listings.
Punta Shoppingemperador · Retail & E-Commerce
bio3g.comqilin · Healthcare
P&B Textilesqilin · Manufacturing
Animart Pet Storesqilin · Retail & E-Commerce
GTL Concreto e Logística LTDAemperador · Manufacturing
Universidade de Passo Fundothegentlemen · Education
Pantanal Agricolathegentlemen · Agriculture and Food Production
Hospital Sírio-LibanêsTHE SEVEN DEADLY SINS · Healthcare
Today’s recommendation: Update or temporarily disable the s2Member plugin and check the other WordPress and Joomla extensions listed, restrict internet exposure of the WAVLINK routers' management interfaces, and apply patches to Secure Access (14.61 or later) as soon as possible. Review recently created administrative accounts and monitor for unusual file uploads and deletions on web servers.
With flaws like these appearing every day in widely used components, the question is not whether they exist but whether any of them is exposed in your own environment, and only validating your attack surface answers that.Find out in minutes, with a free exposure assessment, where your organization is truly exposed.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →