---METADATA---
VENDOR: Apple
PRODUCT: macOS
AFFECTED_VERSIONS: Apple macOS: 0 up to (excluding) 14.8.8, 0 up to (excluding) 15.7.8, 0 up to (excluding) 26.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A permissions vulnerability in macOS allows a malicious application to potentially gain root privileges through restricted system access.

Executive Summary:
A high-severity permissions flaw in Apple macOS allows malicious local applications to escalate privileges to root, with a publicly available proof-of-concept identified.

Vulnerability Details

CVE-ID: CVE-2026-39875

Affected Software: Apple macOS

Affected Versions: Apple macOS: 0 up to (excluding) 14.8.8, 0 up to (excluding) 15.7.8, 0 up to (excluding) 26.6

Vulnerability: This is a privilege escalation vulnerability where a local attacker with low privileges can bypass permission restrictions to execute code with root capabilities. The attack requires local access and the execution of a malicious application.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to organizational security by enabling an attacker to achieve full system control. Successful exploitation results in the complete loss of confidentiality, integrity, and availability, potentially exposing critical business data to unauthorized parties.

Remediation Plan

Immediate Action: Update all affected macOS systems to version 14.8.8, 15.7.8, 26.6, or newer immediately.

Proactive Monitoring: Review system logs for signs of unauthorized root-level process initiation and monitor for unusual activity originating from non-administrative user accounts.

Compensating Controls: Utilize Endpoint Detection and Response (EDR) solutions to identify and block the execution of known exploit payloads or anomalous behavior associated with privilege escalation.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub.

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild, however, a proof-of-concept exists on GitHub, so exploitation risk should be treated as credible. The existence of a public PoC increases the likelihood that threat actors may attempt to weaponize this flaw.

Analyst Recommendation

The presence of a public proof-of-concept elevates the urgency of this remediation. Security teams should expedite patching to prevent attackers from utilizing the available exploit code to gain unauthorized root access to internal systems.

---METADATA---
VENDOR: Apple
PRODUCT: macOS
AFFECTED_VERSIONS: Apple macOS: 0 up to (excluding) 14.8.8, 0 up to (excluding) 15.7.8, 0 up to (excluding) 26.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A permissions vulnerability in macOS allows a malicious application to potentially gain root privileges through restricted system access.

Executive Summary:
A high-severity permissions flaw in Apple macOS allows malicious local applications to escalate privileges to root, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-39874

Affected Software: Apple macOS

Affected Versions: Apple macOS: 0 up to (excluding) 14.8.8, 0 up to (excluding) 15.7.8, 0 up to (excluding) 26.6

Vulnerability: This is a privilege escalation vulnerability where a local attacker with low privileges can bypass permission restrictions to execute code with root capabilities. The attack requires local access and the execution of a malicious application.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk due to the potential for full system compromise. If exploited, an attacker could bypass all security controls, access sensitive data, or install persistent malware, leading to severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: Update all affected macOS systems to version 14.8.8, 15.7.8, 26.6, or newer as provided in the Apple security advisory.

Proactive Monitoring: Monitor system logs for unexpected privilege escalation events, such as unauthorized users gaining superuser access or suspicious process execution patterns.

Compensating Controls: Implement strict application control policies to prevent the execution of untrusted or unsigned binaries, which limits the ability of malicious apps to trigger this vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires local access, the impact of root-level compromise makes prompt patching essential.

Analyst Recommendation

Given the severity of potential root-level escalation, administrators must prioritize the deployment of these security updates across the fleet. Ensuring all systems are patched to the latest versions is the only definitive way to eliminate the risk of privilege escalation via this flaw.

---METADATA---
VENDOR: NixOS
PRODUCT: Nix
AFFECTED_VERSIONS: All versions prior to 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6
---END_METADATA---

Description Summary:
A symlink following vulnerability in the Nix package manager allows users to overwrite files and escalate privileges to root in multi-user installations.

Executive Summary:
A critical privilege escalation vulnerability in the Nix package manager allows local users to overwrite sensitive files and gain root privileges.

Vulnerability Details

CVE-ID: CVE-2026-39860

Affected Software: NixOS Nix

Affected Versions: Prior to 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6

Vulnerability: This is a flaw in the handling of symlinks during fixed-output derivation registration. A local, authenticated attacker can craft a build that follows a symlink to overwrite arbitrary files, including those owned by the root-privileged Nix daemon.

Business Impact

With a CVSS score of 9.0, this vulnerability poses a severe threat to any multi-user Linux environment using Nix. An attacker can achieve complete system compromise by overwriting system binaries or configuration files, leading to unauthorized root-level access and total control over the host.

Remediation Plan

Immediate Action: Upgrade the Nix package manager to the specified patched versions (e.g., 2.34.5 or the relevant maintenance release) immediately.

Proactive Monitoring: Review system logs for unauthorized modifications to critical system files or unusual build processes initiated by non-privileged users.

Compensating Controls: Restrict access to the Nix daemon to only trusted users if an immediate upgrade is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical for multi-user Linux systems. Administrators must prioritize updating the Nix daemon to prevent local privilege escalation, as the current flaw provides a direct path for any user with build access to gain full administrative control.

---METADATA---
VENDOR: Yiisoft
PRODUCT: Yii 2
AFFECTED_VERSIONS: < 2.0.55
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Yii 2 is vulnerable to improper input validation and PHP remote file inclusion, allowing unauthenticated attackers to potentially execute arbitrary code.

Executive Summary:
An unauthenticated remote file inclusion vulnerability in the Yii 2 framework poses a significant risk of unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-39850

Affected Software: Yiisoft Yii 2

Affected Versions: < 2.0.55

Vulnerability: This vulnerability involves improper input validation and improper control of filenames for include/require statements (PHP Remote File Inclusion). The CVSS vector indicates that the attack is network-exploitable without requiring authentication or user interaction.

Business Impact

The ability for an unauthenticated attacker to perform remote file inclusion can lead to complete server compromise, unauthorized data access, and the potential for lateral movement within the network. Although the CVSS score of 7.4 reflects a high severity, the potential for arbitrary code execution necessitates immediate attention to prevent operational disruption and data breaches.

Remediation Plan

Immediate Action: Update the yiisoft/yii2 package to version 2.0.55 or later via your dependency manager (e.g., Composer).

Proactive Monitoring: Monitor web server access and error logs for suspicious file inclusion patterns, such as requests containing unexpected URL parameters or path traversal attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common remote file inclusion (RFI) payloads and suspicious PHP include patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of authentication required, making patching the primary defense.

Analyst Recommendation

This vulnerability represents a critical risk to the integrity of applications built on the Yii 2 framework. Administrators should prioritize updating to version 2.0.55 immediately to eliminate the underlying input validation weakness and prevent potential remote code execution.

---METADATA---
VENDOR: Constant Contact
PRODUCT: Creative Mail – Easier WordPress & WooCommerce Email Marketing
AFFECTED_VERSIONS: 0 through 1.6.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Creative Mail plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'checkout_uuid' parameter.

Executive Summary:
A critical SQL injection vulnerability in the Creative Mail plugin allows unauthenticated attackers to potentially extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-3985

Affected Software: Constant Contact Creative Mail – Easier WordPress & WooCommerce Email Marketing

Affected Versions: 0 through 1.6.9

Vulnerability: The plugin fails to properly sanitize the 'checkout_uuid' parameter before using it in SQL queries. This allows an unauthenticated attacker to inject malicious SQL commands, facilitating unauthorized database interaction.

Business Impact

Successful exploitation allows an attacker to perform unauthorized database queries, which may lead to the exfiltration of sensitive site data, including customer information and configuration details. Given the CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality and should be addressed as a priority to prevent potential regulatory and reputational damage.

Remediation Plan

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and remove the Creative Mail plugin until a fix is released by the vendor.

Proactive Monitoring: Review database query logs for anomalous activity, specifically looking for unexpected SQL syntax or patterns targeting the 'checkout_uuid' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns, which may provide temporary protection against exploitation attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of input sanitization on a publicly accessible parameter.

Analyst Recommendation

The absence of a patch necessitates immediate defensive action. Administrators are urged to prioritize the removal of this plugin to eliminate the attack surface, as SQL injection remains a primary vector for data breaches in WordPress environments.

---METADATA---
VENDOR: Emmett
PRODUCT: Emmett
AFFECTED_VERSIONS: 2.5.0 to before 2.8.1
---END_METADATA---

Description Summary:
The Emmett web framework is vulnerable to path traversal attacks via the RSGI static handler, allowing unauthorized access to arbitrary files.

Executive Summary:
A path traversal vulnerability in Emmett allows an unauthenticated attacker to read arbitrary files on the server by manipulating static file paths.

Vulnerability Details

CVE-ID: CVE-2026-39847

Affected Software: Emmett

Affected Versions: 2.5.0 to before 2.8.1

Vulnerability: The RSGI static handler for internal assets (paths starting with /__emmett__) fails to properly sanitize input. An attacker can use ../ sequences in the URL to escape the assets directory and access sensitive files elsewhere on the filesystem.

Business Impact

This vulnerability (CVSS 9.1) allows for unauthorized disclosure of sensitive system files, configuration files, or source code. The severity is high as it facilitates reconnaissance or direct theft of credentials/secrets, which can be used to further compromise the server environment.

Remediation Plan

Immediate Action: Upgrade the Emmett web framework to version 2.8.1 or later.

Proactive Monitoring: Review web server logs for requests containing ../ sequences directed at the /__emmett__ endpoint.

Compensating Controls: Configure the web server to restrict directory traversal and ensure the web application user has the minimum possible filesystem permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers should prioritize upgrading to version 2.8.1. Given the ease of exploitation for information disclosure, verifying that no sensitive files have been accessed via this method should be a priority during post-patching audits.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Desktop Client
AFFECTED_VERSIONS: Prior to 3.6.4
---END_METADATA---

Description Summary:
SiYuan personal knowledge management system is vulnerable to stored XSS, which can lead to remote code execution in the Electron desktop client.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows an attacker to achieve remote code execution on a victim's machine by syncing a malicious note.

Vulnerability Details

CVE-ID: CVE-2026-39846

Affected Software: SiYuan Desktop Client

Affected Versions: Prior to 3.6.4

Vulnerability: The vulnerability is caused by improper escaping of table caption content, which creates a stored XSS sink. Because the desktop client (based on Electron) operates with nodeIntegration enabled and contextIsolation disabled, the injected JavaScript gains full access to Node.js APIs, enabling remote code execution.

Business Impact

With a CVSS score of 9.0, this flaw poses a severe risk to users. Exploitation allows an attacker to execute arbitrary commands on the user's local workstation, potentially leading to the theft of local credentials, private notes, and complete compromise of the local environment.

Remediation Plan

Immediate Action: Update the SiYuan desktop client to version 3.6.4 or later immediately.

Proactive Monitoring: Users should monitor for suspicious note activity or unexpected synchronization behavior if they suspect their account has been compromised.

Compensating Controls: While difficult to mitigate via network controls, users should avoid syncing or opening notes from untrusted or unknown sources within the SiYuan platform.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.6.4 or later. Given the ability to achieve code execution through simple note synchronization, this update should be treated as a high-priority security maintenance task.

---METADATA---
VENDOR: OpenRemote
PRODUCT: IoT platform
AFFECTED_VERSIONS: 1.21.0 and below
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
OpenRemote contains expression injection vulnerabilities in its rules engine, enabling unauthenticated remote code execution with root-level privileges.

Executive Summary:
A critical expression injection vulnerability in the OpenRemote IoT platform allows attackers to execute arbitrary code with root privileges, leading to full system and multi-tenant compromise.

Vulnerability Details

CVE-ID: CVE-2026-39842

Affected Software: OpenRemote IoT platform

Affected Versions: 1.21.0 and below

Vulnerability: This vulnerability involves an expression injection flaw in the JavaScript and Groovy rules engines. An attacker with the "write:rules" role can bypass authorization and sandbox restrictions to execute arbitrary code with full JVM and root access.

Business Impact

The exploitation of this vulnerability results in complete system compromise, including unauthorized access to sensitive database credentials, arbitrary file reading, and the bypass of multi-tenant security boundaries. Given the CVSS score of 9.9, this represents a severe risk of data exfiltration and total loss of platform integrity, which could lead to significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Upgrade the OpenRemote IoT platform to version 1.22.0 or later immediately to patch the rules engine vulnerabilities.

Proactive Monitoring: Review server logs for suspicious rule creation activity and monitor for unauthorized access attempts to sensitive configuration files or environment variables.

Compensating Controls: Restrict access to the "write:rules" functionality to only the most trusted administrative accounts and utilize network segmentation to isolate the IoT platform from critical infrastructure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability, combined with the potential for complete root-level compromise of the IoT environment, necessitates an immediate update to version 1.22.0. Organizations should prioritize this deployment to prevent unauthorized access and protect sensitive multi-tenant data.

---METADATA---
VENDOR: Go
PRODUCT: Go standard library os
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.12, 1.26.0-0 up to (excluding) 1.26.5, 1.27.0-0 up to (excluding) 1.27.0-rc.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A symlink following vulnerability exists in the Go standard library 'os' package on Unix systems, which could lead to unauthorized file access or modification.

Executive Summary:
A symlink following vulnerability in the Go standard library on Unix systems allows authenticated attackers to potentially gain unauthorized access to or modify files.

Vulnerability Details

CVE-ID: CVE-2026-39822

Affected Software: Go standard library os

Affected Versions: 0 up to (excluding) 1.25.12, 1.26.0-0 up to (excluding) 1.26.5, 1.27.0-0 up to (excluding) 1.27.0-rc.2

Vulnerability: This is a CWE-61 Unix Symbolic Link (Symlink) following vulnerability. The 'os' package fails to properly handle symlinks during file operations, allowing an attacker with local access to manipulate file paths.

Business Impact

An attacker capable of influencing file operations could potentially bypass intended file permissions, leading to unauthorized read or write access to sensitive files on the host system. With a CVSS score of 7.8, this vulnerability poses a substantial risk to systems running Go-based applications, potentially facilitating privilege escalation or data corruption.

Remediation Plan

Immediate Action: Update all Go development environments and compiled applications to the specified patched versions provided in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unexpected file system access patterns or errors related to symlink resolution in applications utilizing the 'os' package.

Compensating Controls: Implement strict file system permissions and use containerization or sandboxing to restrict the reach of applications that might interact with untrusted symlinks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Developers and system administrators must prioritize patching the Go runtime to mitigate this local file system vulnerability. Recompiling applications with the updated Go toolchain is essential to ensure that the security fix is correctly integrated into the affected binaries.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8
---END_METADATA---

Description Summary:
A path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to achieve privilege escalation via crafted file paths.

Executive Summary:
A critical path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to escalate privileges and compromise the system.

Vulnerability Details

CVE-ID: CVE-2026-39813

Affected Software: Fortinet FortiSandbox

Affected Versions: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8

Vulnerability: This is a path traversal flaw residing in the file directory handling logic, which can be triggered by an unauthenticated attacker to manipulate system files and escalate privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to organizational security. Successful exploitation allows an attacker to bypass security boundaries, potentially leading to full system compromise, unauthorized access to sensitive sandbox data, and the ability to execute arbitrary code with elevated privileges.

Remediation Plan

Immediate Action: Update FortiSandbox to the latest vendor-supplied version immediately to patch the directory traversal flaw.

Proactive Monitoring: Review system access logs for anomalous directory traversal patterns or unexpected file modification attempts targeting internal system directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) with rulesets configured to detect and block directory traversal sequences (e.g., ../) in incoming traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators must prioritize patching affected FortiSandbox appliances. The ability for an unauthenticated attacker to achieve privilege escalation represents a severe threat to the integrity and confidentiality of the entire network segment where the sandbox resides.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 4.4.0 through 4.4.8, FortiSandbox PaaS 23.4.4374, 23.4.4350, 23.3.4329, 23.1.4245, 22.2.4151, 22.2.4134, 22.1.4113, 21.4.4072
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fortinet FortiSandbox is vulnerable to OS command injection, allowing unauthenticated attackers to execute unauthorized code on the appliance.

Executive Summary:
A critical OS command injection vulnerability in Fortinet FortiSandbox allows unauthenticated remote attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-39808

Affected Software: Fortinet FortiSandbox

Affected Versions: See metadata for specific version strings.

Vulnerability: This is an OS command injection flaw (CWE-78) where insufficient neutralization of special elements allows attackers to execute unauthorized commands. The vulnerability is remotely exploitable without authentication, making it highly dangerous.

Business Impact

The CVSS score of 9.8 justifies the critical status of this vulnerability. An attacker exploiting this flaw gains complete control over the security appliance, which can be used to bypass security policies, intercept internal traffic, or serve as a beachhead for lateral movement within the enterprise network.

Remediation Plan

Immediate Action: Upgrade to FortiSandbox version 4.4.9 or above, or FortiSandbox PaaS version 5.0.2 or above, as recommended by the vendor.

Proactive Monitoring: Monitor for unexpected command execution patterns or unauthorized changes to system configurations via the management interface.

Compensating Controls: Restrict management interface access to authorized administrative IP addresses via ACLs to prevent unauthenticated access.

Exploitation Status

Public Exploit Available: Yes — multiple proof-of-concept repositories exist on GitHub.

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of multiple PoCs indicates the vulnerability is well-understood by researchers and potential attackers.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, immediate patching is mandatory. Organizations should verify their versions against the vendor's advisory and apply the updates as the highest priority to prevent potential compromise.

---METADATA---
VENDOR: WordPress
PRODUCT: WP-BusinessDirectory
AFFECTED_VERSIONS: <= 4.0.0
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability exists in the WP-BusinessDirectory plugin for WordPress, allowing attackers to upload malicious files.

Executive Summary:
A critical arbitrary file upload vulnerability in the WP-BusinessDirectory WordPress plugin allows remote attackers to execute arbitrary code and compromise the host environment.

Vulnerability Details

CVE-ID: CVE-2026-39591

Affected Software: WordPress WP-BusinessDirectory

Affected Versions: <= 4.0.0

Vulnerability: This vulnerability allows an authenticated attacker (subscriber level) to bypass file type restrictions and upload malicious files, such as web shells, to the server. This facilitates remote code execution and complete site takeover.

Business Impact

The severity of this flaw is reflected in its 9.9 CVSS score, indicating a Critical risk. Successful exploitation can lead to full system compromise, unauthorized data access, and the potential for persistent backdoors, posing a severe threat to business continuity and data integrity.

Remediation Plan

Immediate Action: Update to version 4.0.1 immediately to patch the file upload validation logic.

Proactive Monitoring: Audit the server's uploads directory for unexpected file types or suspicious executable files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block non-standard file extensions and malicious upload requests.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 15, 2026, public exploit code is available for this vulnerability. Given the ease of exploitation, organizations should prioritize patching to prevent active compromise.

Analyst Recommendation

This vulnerability presents a critical threat due to the availability of public exploits and the high impact of remote code execution. Administrators must upgrade to version 4.0.1 immediately and conduct a forensic review of their web directories to ensure no malicious artifacts were introduced prior to the update.

---METADATA---
VENDOR: Unknown
PRODUCT: WP BASE Booking
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability in WP BASE Booking allows unauthorized users to gain elevated administrative permissions.

Executive Summary:
The WP BASE Booking plugin contains a critical unauthenticated privilege escalation flaw that allows attackers to gain administrative access to the platform.

Vulnerability Details

CVE-ID: CVE-2026-39587

Affected Software: Unknown WP BASE Booking

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a privilege escalation vulnerability that does not require prior authentication. By targeting the booking plugin, an attacker can manipulate user roles or permissions, effectively bypassing existing access controls.

Business Impact

A CVSS score of 8.1 reflects the severe risk of unauthorized administrative access. This compromise could allow an attacker to seize control of the entire WordPress installation, modify site content, and access sensitive customer data, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the WP BASE Booking plugin to the latest vendor-patched version immediately.

Proactive Monitoring: Review administrative user lists for unauthorized accounts and monitor audit logs for unexpected privilege changes.

Compensating Controls: Restrict access to the booking management interface using IP allowlisting or additional WAF policies until the vulnerability is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability allows for unauthenticated privilege escalation, it must be addressed as a top priority. Administrators should audit their user accounts immediately to ensure no unauthorized administrative accounts have been created.

---METADATA---
VENDOR: Datalogics
PRODUCT: Ecommerce Delivery
AFFECTED_VERSIONS: Datalogics Ecommerce Delivery <= 2.6.62
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability exists in the Datalogics Ecommerce Delivery WordPress plugin, allowing attackers to gain administrative access.

Executive Summary:
The Datalogics Ecommerce Delivery plugin is affected by a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-39583

Affected Software: Datalogics Ecommerce Delivery

Affected Versions: Datalogics Ecommerce Delivery <= 2.6.62

Vulnerability: This vulnerability allows unauthenticated attackers to elevate their privileges to that of an administrator within the Datalogics Ecommerce Delivery plugin for WordPress, bypassing standard security controls.

Business Impact

The exploit of this vulnerability grants full administrative access to the affected WordPress installation. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete system compromise, unauthorized data exfiltration, and the deployment of malicious payloads, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Datalogics Ecommerce Delivery plugin to version 2.6.63 or later immediately.

Proactive Monitoring: Review WordPress user access logs for suspicious account creation or modifications to administrative user roles.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block unauthorized attempts to access administrative functions or modify user privileges.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to the integrity of the affected environment. Administrators must prioritize updating the plugin to version 2.6.63 or later to mitigate the risk of administrative takeover.

---METADATA---
VENDOR: WP Sessions (Plugin Developer)
PRODUCT: WP Sessions Time Monitoring Full Automatic
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the "WP Sessions Time Monitoring Full Automatic" plugin allows for unauthorized database interaction.

Executive Summary:
A high-severity SQL injection vulnerability in the WP Sessions Time Monitoring plugin enables potential unauthorized database access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-39581

Affected Software: WP Sessions Time Monitoring Full Automatic

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to SQL injection, which can allow an attacker to execute arbitrary database queries. This vulnerability typically targets the plugin's data handling parameters, potentially allowing an attacker to bypass authentication or extract sensitive data.

Business Impact

With a CVSS score of 8.5, this vulnerability poses a severe threat to the integrity and confidentiality of the WordPress database. An attacker could potentially extract sensitive user information, modify site configuration, or gain administrative access to the underlying WordPress instance. This risk is particularly high for sites that store proprietary data or have high user traffic.

Remediation Plan

Immediate Action: Apply vendor patches immediately; if no patch is available, disable or remove the plugin until a secure version is released.

Proactive Monitoring: Enable database query logging and review logs for suspicious patterns, such as SQL syntax errors or unexpected administrative queries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize incoming web requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a critical vulnerability type that should be treated with extreme urgency. Administrators must ensure that the vulnerable plugin is either updated to a version that addresses this flaw or removed from the environment to prevent unauthorized database access.

---METADATA---
VENDOR: bPlugins
PRODUCT: B Blocks
AFFECTED_VERSIONS: bPlugins B Blocks versions up to 2.0.31
---END_METADATA---

Description Summary:
The B Blocks plugin for WordPress contains a privilege escalation vulnerability that allows contributors to gain unauthorized control over the system.

Executive Summary:
A critical privilege escalation vulnerability in the bPlugins B Blocks WordPress plugin allows contributors to gain administrative control over the affected system.

Vulnerability Details

CVE-ID: CVE-2026-39579

Affected Software: bPlugins B Blocks

Affected Versions: bPlugins B Blocks versions up to 2.0.31

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) that allows a user with contributor-level access to elevate their privileges. The vulnerability is remotely exploitable with low attack complexity and does not require user interaction.

Business Impact

Given the CVSS score of 8.8, this flaw represents a significant risk to any WordPress site using the B Blocks plugin. Unauthorized privilege escalation allows an attacker to gain full control over the website, leading to potential data breaches, unauthorized content modification, or the injection of malicious code into the site.

Remediation Plan

Immediate Action: Update the B Blocks plugin to a patched version beyond 2.0.31 immediately.

Proactive Monitoring: Review all user accounts for suspicious activity or unexpected changes in user roles.

Compensating Controls: Temporarily disable the B Blocks plugin if an immediate update cannot be performed to prevent potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user (contributor) to escalate to administrative privileges is a critical security failure. Administrators must audit all user accounts with contributor access and apply the update to the B Blocks plugin as the highest priority to prevent unauthorized site takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: Events Calendar for GeoDirectory
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Events Calendar for GeoDirectory plugin for WordPress contains a PHP object injection vulnerability accessible to authenticated contributors.

Executive Summary:
A PHP object injection vulnerability in the Events Calendar for GeoDirectory plugin allows authenticated contributors to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-39532

Affected Software: WordPress Events Calendar for GeoDirectory

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a PHP object injection vulnerability caused by insecure deserialization of user input. The vulnerability is exploitable by authenticated users holding 'Contributor' capabilities.

Business Impact

Successful exploitation allows for arbitrary code execution, which can lead to the compromise of sensitive database information and full administrative control over the WordPress instance. Given the CVSS score of 8.8, this represents a critical threat to organizational security and data protection.

Remediation Plan

Immediate Action: Ensure the Events Calendar for GeoDirectory plugin is updated to the latest version provided by the vendor.

Proactive Monitoring: Monitor system logs for unauthorized script execution attempts and audit WordPress user roles to ensure the 'Contributor' role is restricted appropriately.

Compensating Controls: Implement a WAF to inspect and block malicious serialized PHP payloads before they reach the application layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, administrators should prioritize updating this plugin immediately. Organizations should verify if the functionality is essential and, if not, consider removing the plugin to reduce the attack surface.

---METADATA---
VENDOR: WP Directory Kit
PRODUCT: WP Directory Kit
AFFECTED_VERSIONS: 1.5.0 and earlier
---END_METADATA---

Description Summary:
The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in the WP Directory Kit plugin for WordPress allows attackers to extract sensitive data from the site database.

Vulnerability Details

CVE-ID: CVE-2026-39531

Affected Software: WP Directory Kit for WordPress

Affected Versions: 1.5.0 and earlier

Vulnerability: The plugin fails to properly neutralize special characters in SQL commands, resulting in a Blind SQL Injection vulnerability. An attacker can craft malicious queries to extract database contents, including user credentials and configuration details.

Business Impact

With a CVSS score of 9.3, this flaw is highly dangerous. It allows for the unauthorized extraction of sensitive data, which could lead to a breach of user information, site compromise, or further attacks facilitated by the stolen data.

Remediation Plan

Immediate Action: Update the WP Directory Kit plugin to the latest version.

Proactive Monitoring: Monitor database query logs for suspicious patterns or anomalous error messages indicative of SQL injection attempts.

Compensating Controls: Use a Web Application Firewall (WAF) to detect and block malicious SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should update this plugin immediately. Given the nature of SQL injection, organizations should also review their database for signs of unauthorized access or data exfiltration following the discovery of this vulnerability.

---METADATA---
VENDOR: 10Web
PRODUCT: Form Maker
AFFECTED_VERSIONS: Form Maker by 10Web <= 1.15.38
---END_METADATA---

Description Summary:
The Form Maker by 10Web plugin for WordPress is vulnerable to unauthenticated SQL injection, allowing attackers to extract information from the database.

Executive Summary:
A critical SQL injection vulnerability in the Form Maker by 10Web plugin permits unauthenticated attackers to gain unauthorized access to sensitive database content.

Vulnerability Details

CVE-ID: CVE-2026-39502

Affected Software: Form Maker by 10Web

Affected Versions: Form Maker by 10Web <= 1.15.38

Vulnerability: This vulnerability arises from improper sanitization of inputs, allowing an unauthenticated attacker to inject malicious SQL commands that the database will execute, leading to data exfiltration.

Business Impact

The CVSS score of 9.3 underscores the risk of this vulnerability. If exploited, it could result in the total compromise of data stored within the plugin, potentially impacting business operations and leading to significant legal and reputational consequences.

Remediation Plan

Immediate Action: Update the Form Maker by 10Web plugin to version 1.15.39 or later.

Proactive Monitoring: Regularly audit database logs for suspicious queries and monitor application traffic for signs of automated SQL injection scanning.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing malicious SQL payloads targeted at the plugin's endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Promptly apply the available patch to mitigate this high-risk vulnerability. Ensuring the plugin is updated is essential to maintaining the confidentiality and integrity of your site's database.

---METADATA---
VENDOR: Simply Schedule Appointments
PRODUCT: Simply Schedule Appointments Plugin
AFFECTED_VERSIONS: Simply Schedule Appointments <= 1.6.9.27
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the Simply Schedule Appointments plugin allows attackers to extract sensitive database information.

Executive Summary:
The Simply Schedule Appointments plugin is affected by a critical SQL injection vulnerability that enables unauthenticated attackers to manipulate database queries and exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-39493

Affected Software: Simply Schedule Appointments

Affected Versions: Simply Schedule Appointments <= 1.6.9.27

Vulnerability: The plugin contains an input validation flaw that allows unauthenticated attackers to append malicious SQL queries, resulting in unauthorized database interaction and data leakage.

Business Impact

The CVSS score of 9.3 highlights the severity of this flaw, which provides a direct path for attackers to compromise sensitive business information stored in the database. Successful exploitation could lead to data theft, loss of customer trust, and potential compliance violations regarding data privacy.

Remediation Plan

Immediate Action: Update the Simply Schedule Appointments plugin to version 1.6.9.28 or later.

Proactive Monitoring: Monitor database logs for unusual query patterns or unexpected database errors that may indicate an ongoing exploitation attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming traffic and block common SQL injection attack signatures.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on this plugin must apply the vendor-provided security update immediately. Given the high severity, remediation should be treated as a priority to prevent data exposure.

---METADATA---
VENDOR: WP Maps
PRODUCT: WP Maps Plugin
AFFECTED_VERSIONS: WP Maps <= 4.9.1
---END_METADATA---

Description Summary:
The WP Maps plugin for WordPress is vulnerable to unauthenticated SQL injection, enabling attackers to extract sensitive information from the database.

Executive Summary:
The WP Maps plugin contains a critical SQL injection vulnerability that allows unauthenticated attackers to access and exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-39492

Affected Software: WP Maps

Affected Versions: WP Maps <= 4.9.1

Vulnerability: The plugin fails to properly sanitize user-supplied parameters, allowing an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Business Impact

With a CVSS score of 9.3, this SQL injection vulnerability poses a severe threat to data confidentiality. Successful exploitation could allow unauthorized parties to bypass authentication and dump sensitive user data, configuration details, or credentials, leading to widespread data breaches.

Remediation Plan

Immediate Action: Update the WP Maps plugin to version 4.9.2 or later as soon as possible.

Proactive Monitoring: Monitor database query logs for anomalous activity, such as unexpected syntax errors or patterns indicative of SQL injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious SQL injection payloads directed at the application.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is required to secure the database against unauthorized access. Failure to update may result in the exposure of sensitive organizational and user data.

---METADATA---
VENDOR: WordPress
PRODUCT: Anti-Malware Security and Brute-Force Firewall
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A PHP object injection vulnerability exists in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress, allowing authenticated contributors to execute arbitrary code.

Executive Summary:
A PHP object injection vulnerability in the Anti-Malware Security and Brute-Force Firewall plugin allows authenticated contributors to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-39478

Affected Software: WordPress Anti-Malware Security and Brute-Force Firewall

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a PHP object injection vulnerability occurring in the plugin's handling of serialized data. The flaw is exploitable by authenticated users with 'Contributor' level access or higher.

Business Impact

Successful exploitation allows an attacker to manipulate serialized objects to achieve remote code execution, potentially leading to full site compromise, data exfiltration, or unauthorized administrative access. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent operational disruption and loss of sensitive data.

Remediation Plan

Immediate Action: Update the Anti-Malware Security and Brute-Force Firewall plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user audit logs for unusual activity from 'Contributor' accounts and monitor server logs for suspicious PHP error patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block malicious serialized objects and restrict plugin access to only trusted user roles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates a rapid response. Administrators should prioritize identifying all instances of the affected plugin and applying the vendor-supplied security patch immediately to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: WordPress
PRODUCT: Post Duplicator
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A PHP object injection vulnerability in the Post Duplicator plugin for WordPress allows authenticated contributors to perform unauthorized actions or execute code.

Executive Summary:
A PHP object injection vulnerability in the Post Duplicator plugin allows authenticated contributors to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-39474

Affected Software: WordPress Post Duplicator

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a PHP object injection vulnerability originating from improper validation of user-supplied input. It requires an attacker to possess at least 'Contributor' level authentication to trigger the flaw.

Business Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code, which can result in complete site takeover, unauthorized modification of database content, and potential malware injection. The CVSS score of 8.8 underscores the high risk to the availability and confidentiality of the affected WordPress environment.

Remediation Plan

Immediate Action: Upgrade the Post Duplicator plugin to the latest version as soon as a security update is released by the developer.

Proactive Monitoring: Monitor site activity for unexpected file modifications and review access logs for requests originating from 'Contributor' accounts that deviate from standard usage.

Compensating Controls: Utilize a WAF to filter malicious input payloads and consider disabling the plugin if the functionality is not critical to business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority. We recommend auditing all sites running the Post Duplicator plugin and applying the vendor's patch immediately upon release to prevent unauthorized system access.

---METADATA---
VENDOR: FreeBSD
PRODUCT: libcasper
AFFECTED_VERSIONS: 15.0-RELEASE < p9, 14.4-RELEASE < p5, 14.3-RELEASE < p14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow in libcasper(3) during UNIX domain socket communication allows local attackers to potentially elevate privileges or cause system crashes.

Executive Summary:
A stack-based buffer overflow in FreeBSD’s libcasper library creates a risk of privilege escalation and system instability for local users.

Vulnerability Details

CVE-ID: CVE-2026-39461

Affected Software: FreeBSD libcasper

Affected Versions: 15.0-RELEASE up to (excluding) p9, 14.4-RELEASE up to (excluding) p5, 14.3-RELEASE up to (excluding) p14

Vulnerability: The vulnerability is a stack-based buffer overflow occurring when libcasper communicates with helper processes via UNIX domain sockets using the select(2) system call. The attack requires local access and low privileges to trigger.

Business Impact

Successful exploitation allows a local attacker to gain elevated privileges, potentially resulting in full system compromise. While the attack requires local access, the CVSS score of 8.8 underscores the severity of the impact on system confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches by updating the FreeBSD system to the latest patch level (15.0-p9, 14.4-p5, or 14.3-p14) using freebsd-update.

Proactive Monitoring: Review system logs for unusual process crashes or segmentation faults, which may indicate attempted exploitation of the buffer overflow.

Compensating Controls: Restrict local user access to the system and ensure that only trusted users have the ability to execute code or interact with system-level services.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of local exploitation remains a barrier, but the high impact warrants prompt patching.

Analyst Recommendation

Given the potential for privilege escalation, administrators of the affected FreeBSD versions must prioritize the installation of these security updates. Failure to patch could allow local users to bypass security controls and gain unauthorized administrative control over the host.

---METADATA---
VENDOR: KuantoKusta
PRODUCT: Feed KuantoKusta for WooCommerce
AFFECTED_VERSIONS: <= 5.3
---END_METADATA---

Description Summary:
The Feed KuantoKusta for WooCommerce plugin contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Feed KuantoKusta for WooCommerce plugin allows remote attackers to execute arbitrary database commands and compromise sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-39441

Affected Software: KuantoKusta Feed KuantoKusta for WooCommerce

Affected Versions: <= 5.3

Vulnerability: This is an unauthenticated SQL injection vulnerability. It allows remote, unauthenticated attackers to inject malicious SQL commands into the backend database, bypassing application logic.

Business Impact

The CVSS score of 9.3 highlights a critical risk to data confidentiality and integrity. Successful exploitation could allow an attacker to extract entire customer databases, modify transaction records, or potentially gain administrative access to the WordPress environment.

Remediation Plan

Immediate Action: Update the Feed KuantoKusta for WooCommerce plugin to a version greater than 5.3.

Proactive Monitoring: Monitor database query logs for unusual or malformed queries, particularly those containing SQL syntax characters (e.g., ', --, UNION).

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection protection enabled to block malicious payloads before they reach the database layer.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the high CVSS score and the sensitive nature of data managed by WooCommerce plugins, this update should be treated with high priority. Organizations must ensure all plugins are updated to the secure version to prevent database compromise.