---METADATA---
VENDOR: loopus WP
PRODUCT: WP Attractive Donations System - Easy Stripe & Paypal donations
AFFECTED_VERSIONS: n/a through 1.25
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The WP Attractive Donations System WordPress plugin is vulnerable to Blind SQL Injection, allowing unauthenticated attackers to manipulate database queries via the plugin.

Executive Summary:
A critical Blind SQL Injection vulnerability in the WP Attractive Donations System plugin allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-28115

Affected Software: loopus WP Attractive Donations System - Easy Stripe & Paypal donations

Affected Versions: n/a through 1.25

Vulnerability: This is a Blind SQL Injection vulnerability (CWE-89) that fails to properly neutralize special characters in SQL commands. The flaw is accessible to unauthenticated remote attackers, allowing them to interfere with the application's database operations.

Business Impact

Successful exploitation allows an attacker to extract sensitive information or alter database content, potentially leading to a full compromise of the WordPress site's data. Although the CVSS score is 9.3, the absence of a vendor-provided patch necessitates immediate defensive action to prevent data theft or unauthorized administrative access.

Remediation Plan

Immediate Action: Since no official patch is available, immediately deactivate or uninstall the WP Attractive Donations System plugin until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns or anomalous SQL syntax that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeted at WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe due to its remote, unauthenticated nature.

Analyst Recommendation

Because there is no currently available patch, the only effective way to mitigate this risk is to discontinue the use of the affected plugin. Administrators should monitor vendor channels for updates and only re-enable the plugin if a verified, secure version is released.

---METADATA---
VENDOR: WPMU DEV
PRODUCT: Forminator
AFFECTED_VERSIONS: n/a through 1.56.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WPMU DEV Forminator plugin for WordPress contains an incorrect privilege assignment vulnerability, allowing authenticated contributors to escalate their privileges.

Executive Summary:
An authenticated privilege escalation vulnerability in the WPMU DEV Forminator plugin allows low-privileged users to gain elevated access within the WordPress environment.

Vulnerability Details

CVE-ID: CVE-2026-28111

Affected Software: WPMU DEV Forminator

Affected Versions: n/a through 1.56.0

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) that occurs due to a lack of proper capability checks. An attacker with contributor-level authentication can exploit this flaw to perform unauthorized actions typically reserved for higher-privileged users.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the WordPress site. By escalating privileges, an attacker could gain administrative control, potentially leading to unauthorized data access, modification of site content, or the injection of malicious code. Given the CVSS score of 8.8, this poses a significant risk to organizational data integrity and system availability.

Remediation Plan

Immediate Action: Update the WordPress Forminator plugin to version 1.56.0.1 or later to resolve the vulnerability.

Proactive Monitoring: Review WordPress user account activity and audit logs for unusual administrative actions performed by accounts assigned the contributor role.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block suspicious privilege escalation attempts or unauthorized requests to administrative endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it directly bypasses the intended role-based access control architecture of the platform.

Analyst Recommendation

The high CVSS score reflects the serious nature of privilege escalation within a content management system. Administrators should prioritize updating the Forminator plugin immediately to prevent potential site takeovers. Ensure that all plugin updates are tested in a staging environment before deployment to production.

---METADATA---
VENDOR: ThemeREX
PRODUCT: Good Energy - Ecology & Renewable Energy WordPress Theme
AFFECTED_VERSIONS: n/a through 1.7.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Good Energy WordPress theme contains a PHP Object Injection vulnerability due to insecure deserialization of untrusted data, allowing unauthenticated remote code execution.

Executive Summary:
A critical deserialization vulnerability in the Good Energy WordPress theme allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28105

Affected Software: ThemeREX Good Energy - Ecology & Renewable Energy WordPress Theme

Affected Versions: n/a through 1.7.7

Vulnerability: This is a Deserialization of Untrusted Data vulnerability (CWE-502). By providing malicious serialized objects, an unauthenticated attacker can trigger code execution within the context of the web server.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating the highest level of risk. An attacker can achieve complete server compromise, leading to total loss of confidentiality, integrity, and availability of the affected WordPress installation and potentially the underlying server infrastructure.

Remediation Plan

Immediate Action: As no patch is currently available, immediately deactivate or remove the Good Energy theme from all production WordPress environments.

Proactive Monitoring: Review web server access logs for requests containing serialized PHP objects or suspicious POST parameters that do not conform to expected application traffic.

Compensating Controls: Utilize a WAF to inspect incoming traffic and block requests containing serialized PHP objects that attempt to exploit deserialization flaws.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The mechanism of PHP object injection is a known, high-impact vector for remote code execution.

Analyst Recommendation

Due to the critical nature of remote code execution vulnerabilities, the affected theme should be removed immediately. Do not resume use of this theme until the vendor releases an update explicitly addressing this deserialization flaw.

---METADATA---
VENDOR: ThemeREX
PRODUCT: Pizza House
AFFECTED_VERSIONS: 0 through 1.4.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The ThemeREX Pizza House WordPress theme is vulnerable to PHP object injection via insecure deserialization of untrusted data, potentially leading to remote code execution.

Executive Summary:
A critical deserialization vulnerability in the ThemeREX Pizza House WordPress theme allows unauthenticated attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-28074

Affected Software: ThemeREX Pizza House

Affected Versions: 0 through 1.4.0

Vulnerability: This is a deserialization of untrusted data (CWE-502) vulnerability. The flaw allows unauthenticated, remote attackers to inject malicious PHP objects, which can be leveraged to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation. Given the CVSS score of 9.8, the business impact is severe, including potential data exfiltration, complete system compromise, and the ability to pivot into the underlying server infrastructure.

Remediation Plan

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and remove the Pizza House theme from their environment until a security update is provided by the vendor.

Proactive Monitoring: Review web server and WordPress application logs for suspicious serialized strings or unusual post requests directed at theme-specific files.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts or common PHP object injection payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dangerous due to its unauthenticated nature and the potential for full system compromise.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the critical severity of the vulnerability, immediate removal of the theme is the only effective mitigation. Organizations should prioritize migrating to a secure, actively maintained theme to eliminate this risk entirely.