---METADATA---
VENDOR: WordPress
PRODUCT: WP-BusinessDirectory
AFFECTED_VERSIONS: <= 4.0.0
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability exists in the WP-BusinessDirectory plugin for WordPress, allowing attackers to upload malicious files.

Executive Summary:
A critical arbitrary file upload vulnerability in the WP-BusinessDirectory WordPress plugin allows remote attackers to execute arbitrary code and compromise the host environment.

Vulnerability Details

CVE-ID: CVE-2026-39591

Affected Software: WordPress WP-BusinessDirectory

Affected Versions: <= 4.0.0

Vulnerability: This vulnerability allows an authenticated attacker (subscriber level) to bypass file type restrictions and upload malicious files, such as web shells, to the server. This facilitates remote code execution and complete site takeover.

Business Impact

The severity of this flaw is reflected in its 9.9 CVSS score, indicating a Critical risk. Successful exploitation can lead to full system compromise, unauthorized data access, and the potential for persistent backdoors, posing a severe threat to business continuity and data integrity.

Remediation Plan

Immediate Action: Update to version 4.0.1 immediately to patch the file upload validation logic.

Proactive Monitoring: Audit the server's uploads directory for unexpected file types or suspicious executable files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block non-standard file extensions and malicious upload requests.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 15, 2026, public exploit code is available for this vulnerability. Given the ease of exploitation, organizations should prioritize patching to prevent active compromise.

Analyst Recommendation

This vulnerability presents a critical threat due to the availability of public exploits and the high impact of remote code execution. Administrators must upgrade to version 4.0.1 immediately and conduct a forensic review of their web directories to ensure no malicious artifacts were introduced prior to the update.

---METADATA---
VENDOR: Unknown
PRODUCT: WP BASE Booking
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability in WP BASE Booking allows unauthorized users to gain elevated administrative permissions.

Executive Summary:
The WP BASE Booking plugin contains a critical unauthenticated privilege escalation flaw that allows attackers to gain administrative access to the platform.

Vulnerability Details

CVE-ID: CVE-2026-39587

Affected Software: Unknown WP BASE Booking

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a privilege escalation vulnerability that does not require prior authentication. By targeting the booking plugin, an attacker can manipulate user roles or permissions, effectively bypassing existing access controls.

Business Impact

A CVSS score of 8.1 reflects the severe risk of unauthorized administrative access. This compromise could allow an attacker to seize control of the entire WordPress installation, modify site content, and access sensitive customer data, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the WP BASE Booking plugin to the latest vendor-patched version immediately.

Proactive Monitoring: Review administrative user lists for unauthorized accounts and monitor audit logs for unexpected privilege changes.

Compensating Controls: Restrict access to the booking management interface using IP allowlisting or additional WAF policies until the vulnerability is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability allows for unauthenticated privilege escalation, it must be addressed as a top priority. Administrators should audit their user accounts immediately to ensure no unauthorized administrative accounts have been created.

---METADATA---
VENDOR: Datalogics
PRODUCT: Ecommerce Delivery
AFFECTED_VERSIONS: Datalogics Ecommerce Delivery <= 2.6.62
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability exists in the Datalogics Ecommerce Delivery WordPress plugin, allowing attackers to gain administrative access.

Executive Summary:
The Datalogics Ecommerce Delivery plugin is affected by a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-39583

Affected Software: Datalogics Ecommerce Delivery

Affected Versions: Datalogics Ecommerce Delivery <= 2.6.62

Vulnerability: This vulnerability allows unauthenticated attackers to elevate their privileges to that of an administrator within the Datalogics Ecommerce Delivery plugin for WordPress, bypassing standard security controls.

Business Impact

The exploit of this vulnerability grants full administrative access to the affected WordPress installation. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete system compromise, unauthorized data exfiltration, and the deployment of malicious payloads, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Datalogics Ecommerce Delivery plugin to version 2.6.63 or later immediately.

Proactive Monitoring: Review WordPress user access logs for suspicious account creation or modifications to administrative user roles.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block unauthorized attempts to access administrative functions or modify user privileges.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to the integrity of the affected environment. Administrators must prioritize updating the plugin to version 2.6.63 or later to mitigate the risk of administrative takeover.

---METADATA---
VENDOR: WP Sessions (Plugin Developer)
PRODUCT: WP Sessions Time Monitoring Full Automatic
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the "WP Sessions Time Monitoring Full Automatic" plugin allows for unauthorized database interaction.

Executive Summary:
A high-severity SQL injection vulnerability in the WP Sessions Time Monitoring plugin enables potential unauthorized database access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-39581

Affected Software: WP Sessions Time Monitoring Full Automatic

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to SQL injection, which can allow an attacker to execute arbitrary database queries. This vulnerability typically targets the plugin's data handling parameters, potentially allowing an attacker to bypass authentication or extract sensitive data.

Business Impact

With a CVSS score of 8.5, this vulnerability poses a severe threat to the integrity and confidentiality of the WordPress database. An attacker could potentially extract sensitive user information, modify site configuration, or gain administrative access to the underlying WordPress instance. This risk is particularly high for sites that store proprietary data or have high user traffic.

Remediation Plan

Immediate Action: Apply vendor patches immediately; if no patch is available, disable or remove the plugin until a secure version is released.

Proactive Monitoring: Enable database query logging and review logs for suspicious patterns, such as SQL syntax errors or unexpected administrative queries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize incoming web requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a critical vulnerability type that should be treated with extreme urgency. Administrators must ensure that the vulnerable plugin is either updated to a version that addresses this flaw or removed from the environment to prevent unauthorized database access.

---METADATA---
VENDOR: bPlugins
PRODUCT: B Blocks
AFFECTED_VERSIONS: bPlugins B Blocks versions up to 2.0.31
---END_METADATA---

Description Summary:
The B Blocks plugin for WordPress contains a privilege escalation vulnerability that allows contributors to gain unauthorized control over the system.

Executive Summary:
A critical privilege escalation vulnerability in the bPlugins B Blocks WordPress plugin allows contributors to gain administrative control over the affected system.

Vulnerability Details

CVE-ID: CVE-2026-39579

Affected Software: bPlugins B Blocks

Affected Versions: bPlugins B Blocks versions up to 2.0.31

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) that allows a user with contributor-level access to elevate their privileges. The vulnerability is remotely exploitable with low attack complexity and does not require user interaction.

Business Impact

Given the CVSS score of 8.8, this flaw represents a significant risk to any WordPress site using the B Blocks plugin. Unauthorized privilege escalation allows an attacker to gain full control over the website, leading to potential data breaches, unauthorized content modification, or the injection of malicious code into the site.

Remediation Plan

Immediate Action: Update the B Blocks plugin to a patched version beyond 2.0.31 immediately.

Proactive Monitoring: Review all user accounts for suspicious activity or unexpected changes in user roles.

Compensating Controls: Temporarily disable the B Blocks plugin if an immediate update cannot be performed to prevent potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user (contributor) to escalate to administrative privileges is a critical security failure. Administrators must audit all user accounts with contributor access and apply the update to the B Blocks plugin as the highest priority to prevent unauthorized site takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: Events Calendar for GeoDirectory
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Events Calendar for GeoDirectory plugin for WordPress contains a PHP object injection vulnerability accessible to authenticated contributors.

Executive Summary:
A PHP object injection vulnerability in the Events Calendar for GeoDirectory plugin allows authenticated contributors to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-39532

Affected Software: WordPress Events Calendar for GeoDirectory

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a PHP object injection vulnerability caused by insecure deserialization of user input. The vulnerability is exploitable by authenticated users holding 'Contributor' capabilities.

Business Impact

Successful exploitation allows for arbitrary code execution, which can lead to the compromise of sensitive database information and full administrative control over the WordPress instance. Given the CVSS score of 8.8, this represents a critical threat to organizational security and data protection.

Remediation Plan

Immediate Action: Ensure the Events Calendar for GeoDirectory plugin is updated to the latest version provided by the vendor.

Proactive Monitoring: Monitor system logs for unauthorized script execution attempts and audit WordPress user roles to ensure the 'Contributor' role is restricted appropriately.

Compensating Controls: Implement a WAF to inspect and block malicious serialized PHP payloads before they reach the application layer.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for remote code execution, administrators should prioritize updating this plugin immediately. Organizations should verify if the functionality is essential and, if not, consider removing the plugin to reduce the attack surface.

---METADATA---
VENDOR: WP Directory Kit
PRODUCT: WP Directory Kit
AFFECTED_VERSIONS: 1.5.0 and earlier
---END_METADATA---

Description Summary:
The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to extract sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in the WP Directory Kit plugin for WordPress allows attackers to extract sensitive data from the site database.

Vulnerability Details

CVE-ID: CVE-2026-39531

Affected Software: WP Directory Kit for WordPress

Affected Versions: 1.5.0 and earlier

Vulnerability: The plugin fails to properly neutralize special characters in SQL commands, resulting in a Blind SQL Injection vulnerability. An attacker can craft malicious queries to extract database contents, including user credentials and configuration details.

Business Impact

With a CVSS score of 9.3, this flaw is highly dangerous. It allows for the unauthorized extraction of sensitive data, which could lead to a breach of user information, site compromise, or further attacks facilitated by the stolen data.

Remediation Plan

Immediate Action: Update the WP Directory Kit plugin to the latest version.

Proactive Monitoring: Monitor database query logs for suspicious patterns or anomalous error messages indicative of SQL injection attempts.

Compensating Controls: Use a Web Application Firewall (WAF) to detect and block malicious SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should update this plugin immediately. Given the nature of SQL injection, organizations should also review their database for signs of unauthorized access or data exfiltration following the discovery of this vulnerability.

---METADATA---
VENDOR: 10Web
PRODUCT: Form Maker
AFFECTED_VERSIONS: Form Maker by 10Web <= 1.15.38
---END_METADATA---

Description Summary:
The Form Maker by 10Web plugin for WordPress is vulnerable to unauthenticated SQL injection, allowing attackers to extract information from the database.

Executive Summary:
A critical SQL injection vulnerability in the Form Maker by 10Web plugin permits unauthenticated attackers to gain unauthorized access to sensitive database content.

Vulnerability Details

CVE-ID: CVE-2026-39502

Affected Software: Form Maker by 10Web

Affected Versions: Form Maker by 10Web <= 1.15.38

Vulnerability: This vulnerability arises from improper sanitization of inputs, allowing an unauthenticated attacker to inject malicious SQL commands that the database will execute, leading to data exfiltration.

Business Impact

The CVSS score of 9.3 underscores the risk of this vulnerability. If exploited, it could result in the total compromise of data stored within the plugin, potentially impacting business operations and leading to significant legal and reputational consequences.

Remediation Plan

Immediate Action: Update the Form Maker by 10Web plugin to version 1.15.39 or later.

Proactive Monitoring: Regularly audit database logs for suspicious queries and monitor application traffic for signs of automated SQL injection scanning.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing malicious SQL payloads targeted at the plugin's endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Promptly apply the available patch to mitigate this high-risk vulnerability. Ensuring the plugin is updated is essential to maintaining the confidentiality and integrity of your site's database.

---METADATA---
VENDOR: Simply Schedule Appointments
PRODUCT: Simply Schedule Appointments Plugin
AFFECTED_VERSIONS: Simply Schedule Appointments <= 1.6.9.27
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in the Simply Schedule Appointments plugin allows attackers to extract sensitive database information.

Executive Summary:
The Simply Schedule Appointments plugin is affected by a critical SQL injection vulnerability that enables unauthenticated attackers to manipulate database queries and exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-39493

Affected Software: Simply Schedule Appointments

Affected Versions: Simply Schedule Appointments <= 1.6.9.27

Vulnerability: The plugin contains an input validation flaw that allows unauthenticated attackers to append malicious SQL queries, resulting in unauthorized database interaction and data leakage.

Business Impact

The CVSS score of 9.3 highlights the severity of this flaw, which provides a direct path for attackers to compromise sensitive business information stored in the database. Successful exploitation could lead to data theft, loss of customer trust, and potential compliance violations regarding data privacy.

Remediation Plan

Immediate Action: Update the Simply Schedule Appointments plugin to version 1.6.9.28 or later.

Proactive Monitoring: Monitor database logs for unusual query patterns or unexpected database errors that may indicate an ongoing exploitation attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming traffic and block common SQL injection attack signatures.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on this plugin must apply the vendor-provided security update immediately. Given the high severity, remediation should be treated as a priority to prevent data exposure.

---METADATA---
VENDOR: WP Maps
PRODUCT: WP Maps Plugin
AFFECTED_VERSIONS: WP Maps <= 4.9.1
---END_METADATA---

Description Summary:
The WP Maps plugin for WordPress is vulnerable to unauthenticated SQL injection, enabling attackers to extract sensitive information from the database.

Executive Summary:
The WP Maps plugin contains a critical SQL injection vulnerability that allows unauthenticated attackers to access and exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-39492

Affected Software: WP Maps

Affected Versions: WP Maps <= 4.9.1

Vulnerability: The plugin fails to properly sanitize user-supplied parameters, allowing an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Business Impact

With a CVSS score of 9.3, this SQL injection vulnerability poses a severe threat to data confidentiality. Successful exploitation could allow unauthorized parties to bypass authentication and dump sensitive user data, configuration details, or credentials, leading to widespread data breaches.

Remediation Plan

Immediate Action: Update the WP Maps plugin to version 4.9.2 or later as soon as possible.

Proactive Monitoring: Monitor database query logs for anomalous activity, such as unexpected syntax errors or patterns indicative of SQL injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious SQL injection payloads directed at the application.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is required to secure the database against unauthorized access. Failure to update may result in the exposure of sensitive organizational and user data.

---METADATA---
VENDOR: WordPress
PRODUCT: Anti-Malware Security and Brute-Force Firewall
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A PHP object injection vulnerability exists in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress, allowing authenticated contributors to execute arbitrary code.

Executive Summary:
A PHP object injection vulnerability in the Anti-Malware Security and Brute-Force Firewall plugin allows authenticated contributors to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-39478

Affected Software: WordPress Anti-Malware Security and Brute-Force Firewall

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a PHP object injection vulnerability occurring in the plugin's handling of serialized data. The flaw is exploitable by authenticated users with 'Contributor' level access or higher.

Business Impact

Successful exploitation allows an attacker to manipulate serialized objects to achieve remote code execution, potentially leading to full site compromise, data exfiltration, or unauthorized administrative access. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent operational disruption and loss of sensitive data.

Remediation Plan

Immediate Action: Update the Anti-Malware Security and Brute-Force Firewall plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user audit logs for unusual activity from 'Contributor' accounts and monitor server logs for suspicious PHP error patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block malicious serialized objects and restrict plugin access to only trusted user roles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates a rapid response. Administrators should prioritize identifying all instances of the affected plugin and applying the vendor-supplied security patch immediately to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: WordPress
PRODUCT: Post Duplicator
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A PHP object injection vulnerability in the Post Duplicator plugin for WordPress allows authenticated contributors to perform unauthorized actions or execute code.

Executive Summary:
A PHP object injection vulnerability in the Post Duplicator plugin allows authenticated contributors to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-39474

Affected Software: WordPress Post Duplicator

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a PHP object injection vulnerability originating from improper validation of user-supplied input. It requires an attacker to possess at least 'Contributor' level authentication to trigger the flaw.

Business Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code, which can result in complete site takeover, unauthorized modification of database content, and potential malware injection. The CVSS score of 8.8 underscores the high risk to the availability and confidentiality of the affected WordPress environment.

Remediation Plan

Immediate Action: Upgrade the Post Duplicator plugin to the latest version as soon as a security update is released by the developer.

Proactive Monitoring: Monitor site activity for unexpected file modifications and review access logs for requests originating from 'Contributor' accounts that deviate from standard usage.

Compensating Controls: Utilize a WAF to filter malicious input payloads and consider disabling the plugin if the functionality is not critical to business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability with high priority. We recommend auditing all sites running the Post Duplicator plugin and applying the vendor's patch immediately upon release to prevent unauthorized system access.

---METADATA---
VENDOR: FreeBSD Project
PRODUCT: libcasper
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
A vulnerability in the libcasper(3) library involves improper handling of UNIX domain sockets and the select(2) system call during communication with helper processes.

Executive Summary:
The libcasper(3) library is susceptible to a vulnerability involving inter-process communication that could lead to system-level security compromises.

Vulnerability Details

CVE-ID: CVE-2026-39461

Affected Software: FreeBSD Project, libcasper

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to how libcasper(3) manages data availability via the select(2) system call when communicating with helper processes over UNIX domain sockets. It is unclear if this requires local access or specific authenticated context.

Business Impact

With a CVSS score of 8.8 (High), this vulnerability presents a significant risk to the host system. Exploitation could potentially allow an attacker to disrupt system services, escalate privileges, or gain unauthorized control over processes interacting with the vulnerable library.

Remediation Plan

Immediate Action: Apply security updates provided by the vendor or the FreeBSD Project as soon as they become available.

Proactive Monitoring: Monitor system logs for errors related to socket communication or unexpected process crashes involving libcasper.

Compensating Controls: Restrict access to local system resources and monitor for unauthorized process execution to mitigate potential lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability should be prioritized for patching. Administrators should track the official FreeBSD security bulletins for patch availability and apply them to all affected systems immediately.

---METADATA---
VENDOR: KuantoKusta
PRODUCT: Feed KuantoKusta for WooCommerce
AFFECTED_VERSIONS: <= 5.3
---END_METADATA---

Description Summary:
The Feed KuantoKusta for WooCommerce plugin contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Feed KuantoKusta for WooCommerce plugin allows remote attackers to execute arbitrary database commands and compromise sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-39441

Affected Software: KuantoKusta Feed KuantoKusta for WooCommerce

Affected Versions: <= 5.3

Vulnerability: This is an unauthenticated SQL injection vulnerability. It allows remote, unauthenticated attackers to inject malicious SQL commands into the backend database, bypassing application logic.

Business Impact

The CVSS score of 9.3 highlights a critical risk to data confidentiality and integrity. Successful exploitation could allow an attacker to extract entire customer databases, modify transaction records, or potentially gain administrative access to the WordPress environment.

Remediation Plan

Immediate Action: Update the Feed KuantoKusta for WooCommerce plugin to a version greater than 5.3.

Proactive Monitoring: Monitor database query logs for unusual or malformed queries, particularly those containing SQL syntax characters (e.g., ', --, UNION).

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection protection enabled to block malicious payloads before they reach the database layer.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the high CVSS score and the sensitive nature of data managed by WooCommerce plugins, this update should be treated with high priority. Organizations must ensure all plugins are updated to the secure version to prevent database compromise.

---METADATA---
VENDOR: Funnelforms LLC
PRODUCT: FunnelFormsPro
AFFECTED_VERSIONS: n/a through 3.8.1
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
FunnelFormsPro is vulnerable to remote code inclusion via improper control of code generation, allowing unauthenticated attackers to execute arbitrary code on the host server.

Executive Summary:
A critical remote code inclusion vulnerability in FunnelFormsPro allows unauthenticated attackers to execute arbitrary code, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39440

Affected Software: Funnelforms LLC FunnelFormsPro

Affected Versions: n/a through 3.8.1

Vulnerability: This is a code injection vulnerability where the application fails to sanitize input properly, leading to Remote Code Inclusion (RCI). The flaw can be triggered by an unauthenticated attacker, granting them the ability to execute malicious scripts within the context of the web server.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a maximum-severity risk. Successful exploitation allows for complete unauthorized control over the server environment, leading to data exfiltration, service disruption, and the potential for lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update FunnelFormsPro to the latest available version that patches the code inclusion vulnerability.

Proactive Monitoring: Monitor server logs for execution of unexpected system commands or unusual file creation in the web root directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common code injection patterns and suspicious remote file inclusion attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is extremely high.

Analyst Recommendation

This vulnerability must be addressed with the highest level of urgency. Organizations should verify their current version of FunnelFormsPro and apply the necessary updates immediately to prevent remote code execution attacks against their infrastructure.

---METADATA---
VENDOR: NuGet
PRODUCT: NuGetGallery
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: high
MISSING: versions
---END_METADATA---

Description Summary:
A cross-package metadata injection vulnerability in NuGetGallery allows for arbitrary blob writes and potential remote code execution via crafted .nuspec files.

Executive Summary:
A critical vulnerability in the NuGetGallery backend allows attackers to achieve remote code execution and arbitrary file manipulation through malicious metadata injection.

Vulnerability Details

CVE-ID: CVE-2026-39399

Affected Software: NuGet NuGetGallery

Affected Versions: See vendor advisory

Vulnerability: The vulnerability arises from insufficient input validation of .nuspec files and URI fragment injection. This allows an attacker to control resolved blob paths, resulting in RCE or unauthorized modification of repository content.

Business Impact

With a CVSS score of 9.6, this flaw poses a severe risk to the integrity of the software supply chain. Attackers could potentially inject malicious code into software packages, leading to widespread downstream compromise and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Ensure the NuGetGallery environment is updated to include the fix provided in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.

Proactive Monitoring: Monitor repository logs for irregular package metadata patterns or unauthorized attempts to access or modify storage blobs.

Compensating Controls: Implement strict input validation and sandboxing for all package processing pipelines to restrict access to underlying storage containers.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to manipulate package metadata is a high-impact risk for any development environment. Administrators must verify the integrity of their NuGetGallery deployments and apply the necessary code patches immediately to mitigate the risk of supply chain attacks.

---METADATA---
VENDOR: Delmare Digital
PRODUCT: Payload-Puck Plugin
AFFECTED_VERSIONS: Prior to 0.6.23
---END_METADATA---

Description Summary:
The @delmaredigital/payload-puck plugin for PayloadCMS bypasses collection-level access controls, allowing unauthorized API access.

Executive Summary:
An access control bypass in the Payload-Puck plugin for PayloadCMS allows unauthorized users to manipulate data via API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-39397

Affected Software: @delmaredigital/payload-puck

Affected Versions: Prior to 0.6.23

Vulnerability: The createPuckPlugin() function incorrectly calls the Payload local API with overrideAccess: true, which ignores all defined collection-level access rules. This effectively disables security for the affected API endpoints, allowing any user to interact with the data.

Business Impact

This vulnerability (CVSS 9.4) allows unauthorized access to data managed by the Puck visual page builder. The business impact includes potential unauthorized modification or deletion of content, and exposure of sensitive data, which could lead to significant data integrity loss.

Remediation Plan

Immediate Action: Update the @delmaredigital/payload-puck plugin to version 0.6.23 or later.

Proactive Monitoring: Review API access logs for unauthorized CRUD operations directed toward the /api/puck/* endpoints.

Compensating Controls: Implement external API gateway restrictions to enforce authorization rules if the plugin cannot be updated immediately.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin updates should be applied immediately to restore proper access control. Administrators should also conduct an audit of data touched by the Puck plugin to ensure no unauthorized changes were made while the vulnerability was active.

---METADATA---
VENDOR: Genealogy
PRODUCT: Genealogy
AFFECTED_VERSIONS: Prior to 5.9.1
---END_METADATA---

Description Summary:
A broken access control flaw in the Genealogy PHP application allows authenticated users to transfer ownership of arbitrary non-personal team workspaces to their own accounts.

Executive Summary:
A critical access control vulnerability in Genealogy permits authenticated users to perform unauthorized team ownership takeovers.

Vulnerability Details

CVE-ID: CVE-2026-39355

Affected Software: Genealogy

Affected Versions: Prior to 5.9.1

Vulnerability: The application fails to properly validate permissions when transferring team ownership. This allows any authenticated user to escalate their privileges by claiming ownership of teams they do not manage.

Business Impact

This vulnerability presents a significant risk of data exfiltration and unauthorized administrative control over team workspaces. With a CVSS score of 9.9, the impact on organizational data privacy is extreme, as attackers can gain access to all data associated with compromised teams.

Remediation Plan

Immediate Action: Update the Genealogy application to version 5.9.1 or later to remediate the access control logic.

Proactive Monitoring: Audit ownership change logs to identify any unauthorized transfers of team workspaces that occurred prior to patching.

Compensating Controls: Restrict access to the application to trusted internal networks and implement strict session monitoring for unusual account activity.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a standard user to seize control of arbitrary workspaces is a critical security failure. Organizations should prioritize updating to version 5.9.1 to ensure that authorization checks are correctly enforced across all team management functions.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in ChurchCRM's API middleware allows unauthenticated attackers to access protected API endpoints, exposing sensitive member data and system information.

Executive Summary:
A critical authentication bypass in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to gain unauthorized access to restricted API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-39339

Affected Software: ChurchCRM ChurchCRM

Affected Versions: Prior to 7.1.0

Vulnerability: This is an authentication bypass vulnerability located in the ChurchCRM/Slim/Middleware/AuthMiddleware.php file. Unauthenticated attackers can circumvent security controls by injecting "api/public" into the request URL.

Business Impact

The vulnerability poses a severe risk to data confidentiality and integrity, as it allows unauthorized access to church member databases and internal system metadata. With a CVSS score of 9.1, this flaw could lead to mass data exfiltration and potential regulatory non-compliance regarding sensitive personal information.

Remediation Plan

Immediate Action: Upgrade all instances of ChurchCRM to version 7.1.0 or later immediately to apply the necessary middleware security patch.

Proactive Monitoring: Review web server and application access logs for unusual patterns, specifically monitoring for requests containing "api/public" strings targeting protected endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing "api/public" in the URL path until the patch can be deployed.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation and the sensitivity of the data involved, the potential for exploitation is high.

Analyst Recommendation

The severity of this authentication bypass cannot be overstated, as it provides a direct path to sensitive internal data without requiring credentials. Organizations must prioritize the update to version 7.1.0 to eliminate this exposure and prevent unauthorized access to their management systems.