---METADATA---
VENDOR: Shy2593666979
PRODUCT: AgentChat
AFFECTED_VERSIONS: Up to version 2
---END_METADATA---

Description Summary:
A security flaw in Shy2593666979 AgentChat up to version 2 has been identified, potentially allowing for unauthorized system manipulation.

Executive Summary:
A vulnerability in the AgentChat software up to version 2 poses a high risk to application security and could lead to unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-3693

Affected Software: Shy2593666979 AgentChat

Affected Versions: Up to version 2

Vulnerability: A flaw has been identified in the AgentChat application. Although the specific vulnerability type is not detailed, the affected versions suggest an issue in the legacy codebase that could be leveraged by an attacker to bypass security controls or execute unauthorized commands.

Business Impact

The CVSS score of 7.3 indicates a High severity risk. If exploited, this vulnerability could compromise the confidentiality of communications within the AgentChat platform or allow an attacker to gain unauthorized access to the user database, resulting in reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade AgentChat to a version higher than 2.0 or apply the vendor-recommended security patch immediately.

Proactive Monitoring: Monitor for anomalous chat logs or unexpected API calls that deviate from standard user behavior.

Compensating Controls: Ensure that the application is deployed behind a secure gateway and that all user inputs are strictly validated at the server level.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of detailed public disclosure may temporarily limit exploitation, but the risk remains high for outdated versions.

Analyst Recommendation

Organizations using AgentChat must verify their current version and upgrade immediately if they are running version 2 or lower. Securing communication tools is essential for maintaining corporate privacy and preventing unauthorized data disclosure.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Canvas
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in OpenClaw Canvas allows unauthorized access to the application.

Executive Summary:
An authentication bypass vulnerability in OpenClaw Canvas poses a severe risk, potentially allowing unauthorized access to sensitive application functionality.

Vulnerability Details

CVE-ID: CVE-2026-3690

Affected Software: OpenClaw Canvas

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an authentication bypass vulnerability that allows an attacker to circumvent existing security checks, potentially accessing restricted areas of the application without valid credentials.

Business Impact

Successful exploitation could result in unauthorized access to sensitive data and administrative functions within the Canvas application. With a CVSS score of 7.4, the vulnerability represents a high-risk entry point for attackers to compromise user accounts or perform unauthorized actions, leading to potential data breaches and service disruption.

Remediation Plan

Immediate Action: Apply the vendor-supplied security update immediately to patch the authentication bypass mechanism.

Proactive Monitoring: Analyze application access logs for suspicious patterns, such as successful access to protected areas without corresponding authentication events.

Compensating Controls: Implement Web Application Firewall (WAF) rules to detect and block requests that attempt to bypass authentication headers or parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate action is necessary to close this authentication loophole. Security teams should prioritize patching the OpenClaw Canvas application to prevent unauthorized access and protect the confidentiality and integrity of the data managed within the platform.

---METADATA---
VENDOR: wclovers
PRODUCT: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
AFFECTED_VERSIONS: 0 through 2.11.10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The WCFM Membership plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to bypass authorization controls.

Executive Summary:
An Insecure Direct Object Reference vulnerability in the WCFM Membership plugin allows authenticated users to perform unauthorized actions, risking data integrity.

Vulnerability Details

CVE-ID: CVE-2026-3688

Affected Software: wclovers WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

Affected Versions: 0 through 2.11.10

Vulnerability: This is an IDOR vulnerability where the plugin fails to perform adequate authorization checks on user-controlled keys. An authenticated user with low privileges can manipulate requests to access or modify data they are not authorized to interact with.

Business Impact

This vulnerability can lead to unauthorized data manipulation or access within the multivendor marketplace. With a CVSS score of 8.1, the flaw significantly impacts the integrity of the platform, potentially allowing vendors to access or modify membership data belonging to others.

Remediation Plan

Immediate Action: Immediately update the WCFM Membership plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor site traffic and application logs for unusual request patterns targeting membership or user management endpoints.

Compensating Controls: If a patch is not immediately applicable, implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to plugin-specific API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin vulnerabilities in e-commerce environments are frequently targeted. Administrators must verify their current plugin version and apply the vendor-provided update immediately to prevent unauthorized access and potential business logic abuse.

---METADATA---
VENDOR: Gigamon
PRODUCT: GVOS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Gigamon GVOS v5 contains a vulnerability that may expose the system to unauthorized access or operational disruption.

Executive Summary:
Gigamon GVOS v5 is affected by a high-severity vulnerability that poses a significant risk to the integrity and availability of network visibility infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-36848

Affected Software: Gigamon GVOS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the GVOS operating system, though specific technical triggers remain under investigation. Given the nature of network visibility appliances, an attacker may leverage this flaw to gain unauthorized system-level access or disrupt critical traffic monitoring functions.

Business Impact

A successful exploit could lead to full system compromise of the network visibility appliance, potentially allowing attackers to intercept or manipulate network traffic data. With a CVSS score of 7.5, this high-severity flaw represents a substantial threat to organizational security posture and data confidentiality.

Remediation Plan

Immediate Action: Monitor official Gigamon security channels for the release of a patch and apply it to all affected GVOS appliances immediately upon availability.

Proactive Monitoring: Review system access logs for anomalous login attempts or unauthorized configuration changes within the GVOS management interface.

Compensating Controls: Restrict management access to the GVOS appliance to trusted administrative subnets and implement strict firewall rules to prevent exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role of Gigamon appliances in network architecture, the potential for exploitation remains high.

Analyst Recommendation

Organizations utilizing Gigamon GVOS must prioritize this vulnerability. It is recommended to perform an immediate audit of exposed appliances and ensure that security patches are applied as soon as the vendor makes them available to prevent potential unauthorized access.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: N200RE V5
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the TOTOLINK N200RE V5 router allows remote code execution via specifically crafted parameters in the formMapDelDevice function.

Executive Summary:
A critical command injection vulnerability in the TOTOLINK N200RE V5 allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-36841

Affected Software: TOTOLINK N200RE V5

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device fails to properly sanitize input for the 'macstr' and 'bandstr' parameters within the 'formMapDelDevice' function, enabling command injection.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating the highest level of risk. An attacker can gain full control over the affected networking hardware, leading to total network compromise, data interception, and the potential to use the device as a pivot point for further internal network attacks.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by TOTOLINK to address the command injection flaw.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempts to access administrative functions from unexpected sources.

Compensating Controls: Disable remote management interfaces on the WAN side and restrict access to the device management console to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical security risk requiring immediate mitigation. Administrators must ensure the affected firmware is patched immediately to prevent full device compromise by unauthenticated remote actors.

---METADATA---
VENDOR: Panabit
PRODUCT: PAP-XM320
AFFECTED_VERSIONS: Up to and including v7.7
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in the Panabit PAP-XM320 embedded HTTP server allows attackers to bypass login requirements via directory traversal.

Executive Summary:
A critical authentication bypass vulnerability in the Panabit PAP-XM320 embedded HTTP server allows unauthenticated attackers to gain unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-36829

Affected Software: Panabit PAP-XM320

Affected Versions: Up to and including v7.7

Vulnerability: The embedded HTTP server improperly validates session cookies by checking for file existence using user-controlled input. This allows for directory traversal and successful bypass of authentication.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an existential threat to the device, as an attacker can gain full administrative access without credentials. This can lead to the complete compromise of the network appliance and any traffic passing through it.

Remediation Plan

Immediate Action: Update the Panabit PAP-XM320 firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor management interface access logs for signs of directory traversal attempts or unauthorized login bypasses.

Compensating Controls: Place the device management interface behind a VPN or restricted network segment to prevent exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to bypass authentication on a network appliance is extremely high risk. Organizations using the Panabit PAP-XM320 must prioritize firmware updates and ensure the management interface is not accessible from the public internet.

---METADATA---
VENDOR: Panabit
PRODUCT: PAP-XM320
AFFECTED_VERSIONS: Up to and including v7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the Panabit PAP-XM320 /cgi-bin/tools/ajax_cmd endpoint allows authenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in Panabit PAP-XM320 allows authenticated attackers to achieve total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36828

Affected Software: Panabit PAP-XM320

Affected Versions: Up to and including v7

Vulnerability: The vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint, which fails to properly validate input, allowing an authenticated user to execute arbitrary shell commands on the underlying operating system.

Business Impact

The ability to execute arbitrary commands on a network device like the PAP-XM320 poses a severe risk, as it allows for full control of the device, potential lateral movement into the internal network, and interception of traffic. With a CVSS score of 8.8, this vulnerability is highly dangerous; unauthorized access to administrative functions could lead to a total loss of confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Monitor vendor communication channels for security updates and apply them immediately upon release to remediate the command injection flaw.

Proactive Monitoring: Audit device access logs for unusual administrative activity and monitor for unauthorized command execution patterns or unexpected system process creation.

Compensating Controls: Restrict access to the device management interface to only trusted administrative IP addresses via firewall rules to reduce the likelihood of unauthorized exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly severe given the potential for remote code execution.

Analyst Recommendation

Given the existence of a proof-of-concept and the high CVSS severity, this vulnerability should be treated with extreme urgency. Administrators must restrict access to the management interface and apply vendor patches the moment they become available.

---METADATA---
VENDOR: Shopizer
PRODUCT: Shopizer
AFFECTED_VERSIONS: v3.2.5
---END_METADATA---

Description Summary:
A path traversal vulnerability in Shopizer v3.2.5 allows remote attackers to write arbitrary files to any writable path via the image upload endpoint.

Executive Summary:
A critical path traversal vulnerability in Shopizer enables remote attackers to write arbitrary files to the server, resulting in potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-36767

Affected Software: Shopizer

Affected Versions: v3.2.5

Vulnerability: The /content/images/add endpoint lacks sufficient path sanitization. An attacker can submit a crafted POST request to bypass directory restrictions and write files to unintended locations.

Business Impact

With a CVSS score of 10.0, this vulnerability is of the highest urgency. Successful exploitation allows an attacker to write malicious payloads, such as webshells, to the server. This can lead to complete system takeover, unauthorized access to customer databases, and significant reputational harm.

Remediation Plan

Immediate Action: Patch or upgrade Shopizer to the latest version immediately to resolve the path traversal vulnerability.

Proactive Monitoring: Monitor server logs for POST requests to the image upload endpoint that contain path traversal patterns (e.g., ../).

Compensating Controls: Use a WAF to inspect and block incoming HTTP requests containing directory traversal sequences directed at the image upload endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no verified evidence of active exploitation. However, the critical nature of this flaw makes it a primary target for automated scanning and exploitation tools.

Analyst Recommendation

This vulnerability requires immediate intervention. Security teams must ensure that all instances of Shopizer are updated and that file system integrity is verified to ensure no unauthorized files have been planted.

---METADATA---
VENDOR: JeeSite
PRODUCT: JeeSite
AFFECTED_VERSIONS: v5.15.1
---END_METADATA---

Description Summary:
Authenticated attackers with file upload permissions can exploit a path traversal vulnerability in JeeSite v5.15.1 to upload arbitrary files to the filesystem.

Executive Summary:
A high-severity path traversal vulnerability in JeeSite allows authenticated attackers to perform unauthorized file writes, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-36760

Affected Software: JeeSite

Affected Versions: v5.15.1

Vulnerability: The fileMd5 parameter in the /a/file/upload endpoint fails to properly sanitize path inputs. When chunked upload is enabled, an authenticated attacker can write files to arbitrary locations on the server.

Business Impact

This vulnerability carries a CVSS score of 9.6. While it requires authentication, the ability to write arbitrary files allows an attacker to upload malicious scripts (webshells) into executable directories, resulting in full server compromise, data exfiltration, or persistence within the environment.

Remediation Plan

Immediate Action: Upgrade to the latest version of JeeSite that addresses the path traversal flaw in the file upload module.

Proactive Monitoring: Audit the filesystem for unexpected files in upload directories and monitor logs for unusual file upload activity or traversal attempts.

Compensating Controls: Restrict file upload permissions to authorized users only and implement strict validation of file paths and extensions at the application layer.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation. However, the high CVSS score necessitates immediate patch management.

Analyst Recommendation

Organizations should prioritize updating their JeeSite instances. Furthermore, review current user roles and permissions to ensure that the principle of least privilege is enforced regarding file upload capabilities.

---METADATA---
VENDOR: EDIMAX
PRODUCT: BR-6428nS V3
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
The EDIMAX BR-6428nS V3 router is affected by a high-severity vulnerability that could allow unauthorized remote access and total system compromise.

Executive Summary:
A critical vulnerability in the EDIMAX BR-6428nS V3 router exposes the device to unauthorized remote control and potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36734

Affected Software: EDIMAX BR-6428nS V3

Affected Versions: See vendor advisory

Vulnerability: This is a network-accessible vulnerability that allows an authenticated user to perform actions leading to a full compromise of the device's confidentiality, integrity, and availability.

Business Impact

Successful exploitation allows an attacker to gain full control over the network hardware, which can be used to intercept traffic, pivot into internal networks, or disrupt connectivity. With a CVSS score of 8.8, this vulnerability represents a severe risk to network infrastructure and perimeter security.

Remediation Plan

Immediate Action: Check the EDIMAX official support portal for firmware updates and apply them immediately to the affected router hardware.

Proactive Monitoring: Monitor router logs for unauthorized configuration changes, unexpected administrative logins, or unusual outbound traffic from the device.

Compensating Controls: Restrict administrative access to the router’s web interface to a dedicated management VLAN or trusted IP addresses to limit exposure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the high level of control granted upon successful exploitation.

Analyst Recommendation

Given the critical nature of router-based vulnerabilities, immediate firmware updates are required to secure the device. Network administrators should ensure that administrative interfaces are not exposed to the public internet and that all firmware is kept current to mitigate this high-severity risk.

---METADATA---
VENDOR: Bookcars
PRODUCT: Bookcars
AFFECTED_VERSIONS: bookcars version 8.3
---END_METADATA---

Description Summary:
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows for directory traversal and potential arbitrary file manipulation.

Executive Summary:
An unrestricted file rename vulnerability in bookcars version 8.3 allows authenticated attackers to perform directory traversal, posing a significant risk of unauthorized access or remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-36723

Affected Software: Bookcars Bookcars

Affected Versions: bookcars version 8.3

Vulnerability: This vulnerability resides in the /api/create-user component, where improper validation of file rename operations enables directory traversal sequences. While the attack requires authentication, the ability to move files to arbitrary locations on the server filesystem facilitates system-level compromise.

Business Impact

The severity of this flaw is reflected in its CVSS score of 8.8, which indicates a high potential for severe impact. Successful exploitation could allow an attacker to overwrite critical system files or achieve remote code execution, leading to full system compromise, data theft, and significant operational downtime.

Remediation Plan

Immediate Action: Apply the vendor-released patch that fixes the file rename handling in bookcars v8.3, or update the software to a version that addresses this vulnerability.

Proactive Monitoring: Review application access logs for suspicious API requests containing directory traversal patterns (e.g., ../) directed at the /api/create-user endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences and restrict unauthorized access to administrative API endpoints.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 11, 2026, public exploits for this vulnerability are available. Given the potential for remote code execution and the availability of exploit code, organizations must prioritize patching this vulnerability immediately.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the confirmed availability of public exploit material, this vulnerability poses an immediate and elevated risk. Administrators should audit their current version of bookcars and apply the necessary patches immediately to prevent potential system-wide compromise.

---METADATA---
VENDOR: OpenSIPS
PRODUCT: Control Panel (opensips-cp)
AFFECTED_VERSIONS: prior to version 9.3.3
---END_METADATA---

Description Summary:
A Time-Based Blind SQL Injection vulnerability exists in the alias_management module of the OpenSIPS Control Panel.

Executive Summary:
An authenticated SQL injection vulnerability in OpenSIPS Control Panel allows attackers to extract sensitive database information via the alias_management module.

Vulnerability Details

CVE-ID: CVE-2026-36670

Affected Software: OpenSIPS Control Panel

Affected Versions: prior to version 9.3.3

Vulnerability: The alias_management module fails to properly sanitize user inputs, enabling a Time-Based Blind SQL Injection. An authenticated attacker can execute arbitrary SQL commands by manipulating parameters within this module.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk of data breach and unauthorized database modification. Successful exploitation could lead to full database compromise, where sensitive configuration or user data is exfiltrated or manipulated, undermining the security of the entire telephony infrastructure.

Remediation Plan

Immediate Action: Update OpenSIPS Control Panel to version 9.3.3 or later immediately.

Proactive Monitoring: Enable database query logging and monitor for unusual query execution times, which are indicative of time-based injection attacks.

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection detection rules to inspect and block malicious input directed at the alias_management module.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 17, 2026, a public exploit is available for this vulnerability. Given the ease of exploitation, the risk to unpatched systems is critical.

Analyst Recommendation

The availability of a public exploit significantly elevates the risk associated with this vulnerability. Organizations using OpenSIPS Control Panel must upgrade to version 9.3.3 immediately. Security teams should perform a forensic review of database logs to determine if unauthorized access has already occurred.

---METADATA---
VENDOR: WordPress
PRODUCT: wpForo Forum Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 2.

Executive Summary:
An arbitrary file deletion vulnerability in the wpForo Forum WordPress plugin could allow unauthorized removal of critical system files.

Vulnerability Details

CVE-ID: CVE-2026-3666

Affected Software: WordPress wpForo Forum Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin contains a vulnerability that allows for arbitrary file deletion. This can lead to service instability or the deletion of critical configuration files, depending on the attacker's ability to interact with the plugin's functionality.

Business Impact

With a CVSS score of 8.8, this is a high-risk vulnerability. An attacker could potentially disrupt business operations by deleting essential files, leading to site downtime or the removal of security-critical configuration files that could facilitate further system compromise.

Remediation Plan

Immediate Action: Update the wpForo Forum plugin to the latest version immediately to resolve the file deletion flaw.

Proactive Monitoring: Monitor file system integrity and review WordPress logs for unusual activity related to the plugin.

Compensating Controls: Remove the plugin if it is not strictly necessary for business operations, and ensure that the WordPress installation is running with restricted file system permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe and requires immediate remediation. Organizations should update the plugin as soon as a patch is confirmed available by the developer or remove the plugin to eliminate the risk entirely.

---METADATA---
VENDOR: Mercusys
PRODUCT: AC12G (EU) V1 Router
AFFECTED_VERSIONS: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909
---END_METADATA---

Description Summary:
The Mercusys AC12G router allows UPnP AddPortMapping to forward external traffic to the router's own administrative interface, exposing it to unauthorized access.

Executive Summary:
A critical vulnerability in the Mercusys AC12G router’s UPnP implementation allows attackers to expose the device's internal administrative interface to the internet, creating a significant risk of unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-36608

Affected Software: Mercusys AC12G (EU) V1 Router

Affected Versions: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909

Vulnerability: The router's UPnP service improperly validates AddPortMapping requests, allowing an attacker to map external ports to the router's internal administrative interface. This effectively bypasses network segmentation by making the admin panel accessible from outside the local network.

Business Impact

With a CVSS score of 8.8, this flaw is highly critical as it directly exposes administrative controls to external actors. Successful exploitation allows for unauthorized management of the router, potentially resulting in full device control, credential theft, or the interception of sensitive network traffic.

Remediation Plan

Immediate Action: Disable the UPnP feature on the router immediately if it is not strictly required for network operations.

Proactive Monitoring: Audit current port forwarding rules and UPnP mappings to ensure no unintended services or administrative interfaces are exposed to the WAN.

Compensating Controls: Implement a firewall rule to block all inbound traffic to the router's administrative port from external sources, regardless of UPnP settings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Exposing administrative interfaces to the internet is a severe security failure. Organizations should disable UPnP functionality immediately and verify that no management interfaces are accessible from external networks to mitigate the risk of unauthorized exploitation.

---METADATA---
VENDOR: Mercusys
PRODUCT: AC12G (EU) V1 Router
AFFECTED_VERSIONS: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909
---END_METADATA---

Description Summary:
The Mercusys AC12G router contains an unauthenticated brute-force vulnerability in the TDDP password change endpoint due to a lack of rate limiting.

Executive Summary:
An unauthenticated brute-force vulnerability in the Mercusys AC12G router firmware allows attackers to bypass password change protections, posing a significant risk of unauthorized device takeover.

Vulnerability Details

CVE-ID: CVE-2026-36607

Affected Software: Mercusys AC12G (EU) V1 Router

Affected Versions: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909

Vulnerability: This vulnerability resides in the TDDP password change endpoint (code=10), which fails to implement the rate limiting found on the standard login endpoint. An attacker on the adjacent network can perform unlimited password guessing attempts without triggering account lockout mechanisms.

Business Impact

With a CVSS score of 8.8, this high-severity vulnerability could lead to a complete compromise of the router. Successful exploitation grants an attacker full control over the network traffic, potentially leading to unauthorized data interception, device reconfiguration, and lateral movement into the local network.

Remediation Plan

Immediate Action: Consult the vendor security advisory at https://www.mercusys.com/en/support/security-advisory to identify and apply the latest firmware updates.

Proactive Monitoring: Review router access logs for high-frequency requests to the TDDP endpoint originating from internal or adjacent network IP addresses.

Compensating Controls: Restrict management access to the router to trusted administrative IP addresses only, and isolate the management interface from the public-facing or guest network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of rate limiting on critical administrative endpoints represents a significant security oversight. Administrators should prioritize updating the firmware immediately to eliminate the brute-force vector and secure the device against unauthorized access.

---METADATA---
VENDOR: IBM
PRODUCT: Engineering Lifecycle Management
AFFECTED_VERSIONS: IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0
---END_METADATA---

Description Summary:
IBM Engineering Lifecycle Management allows unauthenticated remote attackers to update server property files, potentially resulting in unauthorized access.

Executive Summary:
A critical vulnerability in IBM Engineering Lifecycle Management permits unauthenticated attackers to modify server configurations, leading to unauthorized application access.

Vulnerability Details

CVE-ID: CVE-2026-3660

Affected Software: IBM Engineering Lifecycle Management

Affected Versions: IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0

Vulnerability: An unauthenticated remote attacker can exploit this vulnerability to update server property files, which facilitates unauthorized access to the application.

Business Impact

By enabling unauthorized access, this vulnerability compromises the integrity and confidentiality of the Engineering Lifecycle Management platform. With a CVSS score of 9.8, the risk of data exposure or administrative takeover of the platform is severe, potentially disrupting critical engineering workflows.

Remediation Plan

Immediate Action: Update IBM Engineering Lifecycle Management to the latest version as provided by the vendor.

Proactive Monitoring: Review file integrity logs for unauthorized modifications to server property files and monitor application access logs for suspicious administrative activity.

Compensating Controls: Ensure the application is not directly exposed to the public internet and restrict management access to authorized internal networks.

Exploitation Status

Public Exploit Available: Null

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should check for vendor security bulletins and apply the necessary patches immediately to prevent unauthorized access. Securing the configuration files and limiting network exposure are vital steps in mitigating this critical risk.

---METADATA---
VENDOR: EMQ
PRODUCT: NanoMQ
AFFECTED_VERSIONS: 0.24.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A memory leak vulnerability in EMQ NanoMQ version 0.24.9 allows a remote attacker to trigger a denial of service via the nni_qos_db_set function.

Executive Summary:
A high severity memory leak in EMQ NanoMQ version 0.24.9 allows remote attackers to cause a denial of service through improper resource management.

Vulnerability Details

CVE-ID: CVE-2026-36590

Affected Software: EMQ NanoMQ

Affected Versions: 0.24.9

Vulnerability: The nni_qos_db_set function in the broker_tcp.c component fails to properly manage memory, allowing a remote attacker to exhaust system resources and crash the broker.

Business Impact

The vulnerability carries a CVSS score of 7.5, justifying its high severity. Successful exploitation results in a denial of service, which can cause significant downtime for applications relying on the NanoMQ broker for message transport.

Remediation Plan

Immediate Action: Monitor official vendor communication for a patch release. In the absence of a patch, implement rate limiting on connections to the broker to slow down potential resource exhaustion.

Proactive Monitoring: Monitor system memory usage and broker health metrics for signs of rapid degradation or unexplained consumption.

Compensating Controls: Utilize a firewall to limit incoming connections to the broker from known, trusted IP addresses to reduce the likelihood of remote exploitation.

Exploitation Status

Public Exploit Available: Yes (a proof of concept is available via a public GitHub repository).

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to remote attackers due to the nature of the affected service.

Analyst Recommendation

The availability of a public proof of concept increases the risk of exploitation. Administrators should isolate the broker from public-facing networks and monitor system resources closely until an official patch is applied.

---METADATA---
VENDOR: Openlabs
PRODUCT: docker-wkhtmltopdf-aas
AFFECTED_VERSIONS: All versions up to and including commit 9f50579.
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the app.py component allows unauthenticated attackers to execute arbitrary commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas exposes systems to full remote code execution by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-36576

Affected Software: Openlabs docker-wkhtmltopdf-aas

Affected Versions: All versions up to and including commit 9f50579.

Vulnerability: This is a command injection flaw (CWE-78) located in the app.py component. An unauthenticated attacker can exploit this by submitting a specially crafted POST request, which fails to properly neutralize special elements used in OS commands, resulting in arbitrary code execution.

Business Impact

The CVSS score of 9.8 confirms the extreme severity of this vulnerability. Successful exploitation permits an attacker to gain full control over the underlying host system, leading to total data compromise, lateral movement within the network, and potential disruption of critical business services.

Remediation Plan

Immediate Action: Upgrade to the latest version of docker-wkhtmltopdf-aas to ensure the vulnerable app.py component is patched.

Proactive Monitoring: Inspect application and system logs for suspicious POST requests containing shell metacharacters or unexpected system commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common command injection patterns in HTTP request bodies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of command injection vulnerabilities, organizations must prioritize patching this component. Ensure that any instance of docker-wkhtmltopdf-aas is updated immediately to prevent potential remote compromise of the server infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: OTP Login With Phone Number, OTP Verification Plugin
AFFECTED_VERSIONS: versions 1.8.50 through 1.8.60
---END_METADATA---

Description Summary:
The OTP Login With Phone Number plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to hijack user accounts by exploiting a flawed Firebase verification flow.

Executive Summary:
A critical authentication bypass flaw in the WordPress OTP Login plugin allows unauthenticated attackers to gain administrative access to sites by hijacking legitimate Firebase sessions.

Vulnerability Details

CVE-ID: CVE-2026-3655

Affected Software: WordPress OTP Login With Phone Number, OTP Verification Plugin

Affected Versions: versions 1.8.50 through 1.8.60

Vulnerability: The vulnerability exists in the lwp_ajax_register AJAX handler, where the Firebase session is not correctly bound to the user's phone number. An unauthenticated attacker can verify their own Firebase session but supply a victim's phone number in the request, causing the application to incorrectly authenticate the attacker as that user.

Business Impact

The CVSS score of 9.8 reflects the high risk of account takeover. If an attacker targets an administrator's account, they can gain full control over the WordPress site, leading to complete data loss, site defacement, or the injection of malicious code into the site's front end.

Remediation Plan

Immediate Action: Immediately update the "OTP Login With Phone Number, OTP Verification" plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user account logs for suspicious logins, particularly those involving administrative accounts, and monitor for unauthorized changes to user metadata.

Compensating Controls: Temporarily disable the plugin if an update is not immediately available, or implement a secondary authentication factor (MFA) that is not tied to the vulnerable OTP verification flow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to bypass authentication for administrative accounts makes this a high-priority risk.

Analyst Recommendation

Given that this vulnerability allows for trivial account takeover including administrative accounts, organizations should treat this update as a high priority. Ensure all WordPress sites utilizing this plugin are updated immediately to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: OPSWAT
PRODUCT: AppRemover
AFFECTED_VERSIONS: v2017.10.02.1551 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The OPSWAT AppRemover kernel driver fails to validate privileges in its IOCTL handler, allowing local users to terminate arbitrary processes.

Executive Summary:
A vulnerability in the OPSWAT AppRemover kernel driver (ardrv.sys) allows local users to terminate arbitrary processes, posing a significant risk of security software tampering and denial of service.

Vulnerability Details

CVE-ID: CVE-2026-36425

Affected Software: OPSWAT AppRemover

Affected Versions: v2017.10.02.1551 and earlier

Vulnerability: This is a privilege validation failure within the IOCTL handler 0x2420031 of the kernel driver. Any local user, regardless of their privilege level, can open the device and send requests to terminate processes, effectively bypassing standard access controls.

Business Impact

The ability for a local attacker to terminate arbitrary processes, including endpoint protection or security agents, creates a critical security gap. Successful exploitation leads to a denial of service, potential disabling of defensive tooling, and the facilitation of anti-forensic activities. With a CVSS score of 7.8, this high-severity flaw requires immediate attention to prevent unauthorized disruption of critical security infrastructure.

Remediation Plan

Immediate Action: Identify and inventory systems running the affected version of the OPSWAT AppRemover driver. Restrict access to the driver device object if possible while awaiting an official vendor patch.

Proactive Monitoring: Monitor system logs for unexpected process terminations or events indicating that security services have been forcibly stopped.

Compensating Controls: Use Endpoint Detection and Response (EDR) solutions to monitor for unauthorized attempts to interact with kernel drivers or attempts to terminate protected system processes.

Exploitation Status

Public Exploit Available: Yes: a public proof-of-concept exists on GitHub.

Analyst Notes: As of July 20, 2026, there is no public information indicating active exploitation in the wild, though the availability of a public proof-of-concept makes the exploitation risk credible. The flaw is inherently dangerous because it grants low-privileged users the ability to influence kernel-level operations.

Analyst Recommendation

The risk posed by this driver vulnerability is significant due to the potential for security bypass. Administrators should prioritize the identification of all instances of the affected driver and apply vendor updates as soon as they become available. Until patches are applied, consider isolating affected systems or implementing strict local access controls to limit the attack surface.

---METADATA---
VENDOR: MeiG Smart
PRODUCT: FORGE_SLT711
AFFECTED_VERSIONS: MDM9607.LE.1.0-00110-STD.PROD-1
---END_METADATA---

Description Summary:
The GoAhead web server on MeiG Smart FORGE_SLT711 devices allows unauthenticated remote attackers to perform OS command injection via the /action/SetRemoteAccessCfg endpoint.

Executive Summary:
A critical OS command injection vulnerability in the MeiG Smart FORGE_SLT711 device allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-36356

Affected Software: MeiG Smart FORGE_SLT711 (GoAhead web server)

Affected Versions: MDM9607.LE.1.0-00110-STD.PROD-1

Vulnerability: This is an OS command injection vulnerability residing in the /action/SetRemoteAccessCfg endpoint of the GoAhead web server, which fails to properly sanitize user input before passing it to the underlying system shell.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat, enabling attackers to gain full control over the device at the operating system level. This compromise can lead to data exfiltration, denial of service, or the use of the device as a botnet node within the local network.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Monitor the device for unexpected outbound traffic or anomalous processes running on the system.

Compensating Controls: Restrict access to the device's web management interface via firewall rules to ensure it is not reachable from untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the MeiG Smart FORGE_SLT711 should treat this as a high-priority update. Ensure that all devices are patched and that network-level controls are in place to prevent unauthenticated access to the management interfaces.

---METADATA---
VENDOR: Realtek
PRODUCT: rtl819x Jungle SDK
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Realtek rtl819x Jungle SDK affecting the rtl8192cd Wi-Fi kernel driver, which may allow for unauthorized system impact.

Executive Summary:
The Realtek rtl819x Jungle SDK contains a high-severity flaw in the Wi-Fi kernel driver that could lead to unauthorized system-level access.

Vulnerability Details

CVE-ID: CVE-2026-36355

Affected Software: Realtek rtl819x Jungle SDK

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the rtl8192cd Wi-Fi kernel driver. It involves an improper handling of data within the driver, which may be exploited to compromise the stability or security of the host system.

Business Impact

The CVSS score of 7.7 reflects a high risk to organizations relying on hardware integrated with the Realtek SDK. Successful exploitation could result in the compromise of wireless communications or the host operating system, potentially leading to data exfiltration or denial of service.

Remediation Plan

Immediate Action: Update to the latest firmware or SDK version provided by the hardware manufacturer.

Proactive Monitoring: Monitor network infrastructure logs for abnormal Wi-Fi driver behavior or unexpected system reboots.

Compensating Controls: Restrict access to wireless management interfaces to trusted administrative subnets to minimize the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Hardware administrators must verify the SDK versions used in their wireless equipment and apply vendor-supplied patches promptly. Given the role of the kernel driver in system security, deferring this update is not recommended.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: COMMGR2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Delta Electronics COMMGR2 is affected by a stack-based buffer overflow vulnerability that could lead to arbitrary code execution or system crashes.

Executive Summary:
A critical stack-based buffer overflow in Delta Electronics COMMGR2 allows attackers to potentially execute arbitrary code or cause a total system denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-3630

Affected Software: Delta Electronics COMMGR2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack-based buffer overflow within the COMMGR2 software. While the authentication level is not explicitly defined in the brief, such flaws typically allow an attacker to overwrite memory by sending specially crafted data to a vulnerable function.

Business Impact

A successful exploit of this vulnerability could result in complete system compromise or significant operational downtime. With a CVSS score of 9.8, this is classified as Critical, indicating that the flaw is easily exploitable and carries a high risk of unauthorized remote code execution, which could lead to data theft or the introduction of ransomware into the industrial control environment.

Remediation Plan

Immediate Action: Update Delta Electronics COMMGR2 to the latest available version immediately to patch the buffer overflow flaw.

Proactive Monitoring: Implement network traffic analysis to detect unusual communication patterns or malformed packets directed at the COMMGR2 service.

Compensating Controls: Deploy host-based intrusion prevention systems (HIPS) and restrict network access to the software to authorized administrative workstations only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its critical severity, the potential for exploitation is extremely high once technical details become known.

Analyst Recommendation

The Critical severity of this vulnerability necessitates immediate attention from security teams. Organizations using Delta Electronics COMMGR2 should prioritize the application of the vendor-supplied patch to mitigate the risk of remote code execution and ensure the continued integrity of their control systems.

---METADATA---
VENDOR: Import and export users and customers
PRODUCT: Import and export users and customers
AFFECTED_VERSIONS: Up to and including 1.x
---END_METADATA---

Description Summary:
The Import and export users and customers WordPress plugin is vulnerable to privilege escalation, enabling attackers to gain unauthorized administrative rights.

Executive Summary:
The Import and export users and customers plugin for WordPress contains a high-severity privilege escalation flaw that allows attackers to elevate their access to administrative levels.

Vulnerability Details

CVE-ID: CVE-2026-3629

Affected Software: Import and export users and customers Import and export users and customers

Affected Versions: All versions up to, and including, 1.x

Vulnerability: This plugin is vulnerable to privilege escalation. An authenticated attacker can exploit flaws in the plugin's user management logic to grant themselves administrative privileges, bypassing intended security restrictions.

Business Impact

The impact is a total loss of control over the WordPress site. An attacker gaining administrative access can perform any action, including data exfiltration, site defacement, and the creation of backdoor accounts. The CVSS score of 8.1 indicates a high risk to the organization's digital assets.

Remediation Plan

Immediate Action: Update the plugin to the latest version immediately. If an update is not available, uninstall the plugin until a patch is released.

Proactive Monitoring: Check for any newly created administrator accounts and review the site's user list for discrepancies.

Compensating Controls: Restrict access to user import/export functions to only the most trusted administrators and use file integrity monitoring to detect unauthorized changes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 23, 2026, there is no public information indicating active exploitation. However, plugins that handle user data and permissions are frequently scrutinized by researchers and attackers alike.

Analyst Recommendation

The ability for an attacker to escalate privileges is a critical security failure. Administrators must apply the update immediately or remove the plugin to mitigate the risk of a full site compromise.

---METADATA---
VENDOR: Honeywell
PRODUCT: IQ4x
AFFECTED_VERSIONS: Factory-default configuration
---END_METADATA---

Description Summary:
Honeywell IQ4x controllers allow unauthenticated remote attackers to create administrative accounts and take full control of building management systems.

Executive Summary:
The Honeywell IQ4x building management controller is subject to a critical authentication bypass that allows unauthenticated attackers to gain full administrative control and lock out legitimate users.

Vulnerability Details

CVE-ID: CVE-2026-3611

Affected Software: Honeywell IQ4x building management controller

Affected Versions: Factory-default configuration (prior to user module enablement)

Vulnerability: In its default state, the device's HMI is exposed without authentication. Because the account creation function (U.htm) is accessible to unauthenticated users, an attacker can create an administrative account, which then enables the user module and locks the system under the attacker's credentials.

Business Impact

This vulnerability has a CVSS score of 10.0, the highest possible. An attacker can take complete control of building systems (HVAC, lighting, etc.) and effectively lock out legitimate operators. This poses significant risks to physical safety, operational continuity, and the security of the facility.

Remediation Plan

Immediate Action: Immediately enable the user module by creating a secure administrative account and updating the firmware to the latest version.

Proactive Monitoring: Scan the network for any Honeywell IQ4x devices that are still operating in a factory-default state or showing unauthorized administrative accounts.

Compensating Controls: Ensure that building management controllers are never exposed directly to the public internet and are protected by a VPN or a robust firewall.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 12, 2026, there is no public information indicating active exploitation. However, the "insecure by design" nature of the default configuration makes these devices extremely vulnerable to discovery via automated internet scanning tools.

Analyst Recommendation

This is a critical flaw that requires immediate attention to prevent unauthorized physical infrastructure control. Administrators must ensure that all IQ4x controllers have authentication enabled and are updated to the latest firmware to mitigate this risk.

---METADATA---
VENDOR: Pensar
PRODUCT: apex
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in the @pensar/apex package that could lead to unauthorized system impact.

Executive Summary:
The @pensar/apex package is affected by a critical vulnerability that may allow for significant system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36044

Affected Software: Pensar apex

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is characterized by a high severity score, though specific technical details regarding the vulnerable function or parameter are currently unavailable. Based on the CVSS vector, the attack vector is network-based and requires no authentication, though it does involve user interaction.

Business Impact

The potential for total technical impact presents a significant risk to organizational assets. A successful exploit could lead to unauthorized data access, integrity loss, or service disruption, justifying the 8.8 CVSS severity rating.

Remediation Plan

Immediate Action: Monitor the official @pensar/apex GitHub repository and npm registry for security advisories and patch releases.

Proactive Monitoring: Review application access logs for unusual patterns or unexpected network traffic originating from the apex module.

Compensating Controls: Implement strict network ingress/egress filtering and utilize a Web Application Firewall (WAF) to detect and block common exploit patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of specific technical documentation necessitates a proactive approach to monitoring vendor communications.

Analyst Recommendation

Given the high CVSS score and the potential for total system impact, organizations utilizing the @pensar/apex package should treat this as a high-priority item. Administrators must stay vigilant for updates from the maintainers and apply all security patches immediately upon availability to mitigate the risk of exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: Riaxe Product Customizer
AFFECTED_VERSIONS: 2.1.2 and below
---END_METADATA---

Description Summary:
The Riaxe Product Customizer plugin for WordPress allows unauthenticated attackers to update arbitrary site options via an unprotected AJAX action.

Executive Summary:
A critical privilege escalation vulnerability in the Riaxe Product Customizer plugin enables unauthenticated attackers to modify site settings and gain administrative control.

Vulnerability Details

CVE-ID: CVE-2026-3596

Affected Software: WordPress Riaxe Product Customizer

Affected Versions: 2.1.2 and below

Vulnerability: The plugin provides an unauthenticated AJAX hook ('wp_ajax_nopriv_install-imprint') that lacks any nonce verification or capability checks. This allows attackers to manipulate critical WordPress options, such as enabling user registration and setting the default user role to administrator.

Business Impact

This vulnerability carries a 9.8 CVSS score, enabling complete site compromise. Attackers can gain unauthorized administrative access, leading to full system takeover and potential data theft.

Remediation Plan

Immediate Action: Update to the latest version of the plugin or deactivate the Riaxe Product Customizer immediately if no patch is available.

Proactive Monitoring: Audit the 'wp_options' table for suspicious changes, particularly settings related to user registration and default roles.

Compensating Controls: Utilize a WAF to block unauthorized requests to the 'wp-admin/admin-ajax.php' endpoint that include the 'install-imprint' action.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of basic security checks in this plugin makes it a high-risk vector. Immediate removal or patching is required to prevent unauthorized administrative escalation.