IONIX THREAT CENTER

CVE-2026-61808 is a critical missing-authentication vulnerability (CWE-306) in HKUDS LightRAG, a retrieval-augmented generation tool. By default the LightRAG API server binds to all network interfaces with authentication disabled, allowing an unauthenticated remote attacker to reach sensitive API endpoints. It carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-16038 is a missing authorization (CWE-862) vulnerability in the MStore API WordPress plugin. The plugin does not verify payments with the payment gateway before marking an order as paid, allowing an unauthenticated attacker to mark an arbitrary order as fully paid without paying. It carries a critical CVSS v3.1 base score of 9.1.

CVE-2026-16258 is a critical PHP Object Injection vulnerability (CWE-502, Deserialization of Untrusted Data) in the Ajax Search Lite WordPress plugin. All versions before 4.14.5 are affected, allowing unauthenticated attackers to inject malicious PHP objects. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2022-4995 is an unrestricted file upload vulnerability (CWE-434) in Weaver E-cology that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, leading to remote code execution. It affects Weaver E-cology 9.0 in versions prior to 10.52 and is rated critical.

CVE-2026-14364 is an unauthenticated account takeover vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress (vendor themetechmount), affecting all versions up to and including 1.2.3. The plugin fails to properly validate a user's identity before resetting their password, allowing attackers to seize arbitrary accounts, including administrators. It carries a CRITICAL CVSS v3.1 base score of 9.8.

CVE-2026-14365 is a critical missing-authorization vulnerability (CWE-862) in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. The flaw lets an unauthenticated attacker reset the password of any account, including an administrator, resulting in full account takeover. It carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-14812 is a maximum-severity (CVSS 10.0) flaw in the Premium SEO WordPress plugin, which ships with an embedded malicious backdoor. The plugin allows an unauthenticated, remote attacker to create a hidden administrator account and, in some builds, to achieve remote code execution, server-side request forgery, and arbitrary front-end content injection — resulting in full site compromise.

CVE-2026-16054 is an unauthenticated arbitrary file deletion vulnerability in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before version 1.1.8. Because the plugin's file-deletion routine is gated only by a nonce that unauthenticated users can obtain, anonymous attackers can delete files staged in its upload directory and irreversibly destroy customers' pending order attachments. It is rated Critical with a CVSS base score of 9.1.

CVE-2026-17032 is a critical supply-chain compromise (CWE-912, Hidden Functionality) in which multiple Supsystic Pro WordPress plugins — including Google Maps Easy Pro — were distributed with malicious code through the vendor's compromised update server. An unauthenticated attacker can leverage the embedded backdoor to deploy a second-stage payload, exfiltrate credentials and other sensitive data, and gain full control of affected sites. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-11976 is a critical supply chain compromise affecting MonsterInsights Pro, a Google Analytics plugin for WordPress. Attackers breached the plugin's official AWS S3 update distribution bucket and injected a malicious class-system-check.php file into releases 10.2.0 and 10.2.2, creating a covert backdoor (CWE-912: Hidden Functionality) that grants full remote control of affected sites. Severity is rated 10.0 (Critical).

CVE-2026-28139 is an unauthenticated PHP Object Injection (deserialization of untrusted data) vulnerability in the Ajax Search Lite WordPress plugin by wpdreams. It affects all versions up to and including 4.14.4 and carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-65575 is an unauthenticated PHP Object Injection vulnerability in the Accalia WordPress theme by AncoraThemes, affecting all versions up to and including 1.5.3. It carries a CVSS v3.1 base score of 9.8 (Critical) and can be exploited remotely over the network without authentication or user interaction.

CVE-2026-66662 is an unauthenticated privilege escalation vulnerability in the Frontend Admin by DynamiApps WordPress plugin (slug acf-frontend-form-element) in all versions up to and including 3.29.10. The flaw stems from incorrect privilege assignment (CWE-266) and allows an unauthenticated, network-based attacker to gain elevated permissions. It carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-66447 is an unauthenticated SQL injection vulnerability in the WordPress File Upload plugin for WordPress. Affecting all versions up to and including 5.1.7, it allows a remote, unauthenticated attacker to inject arbitrary SQL through the plugin. It is rated Critical with a CVSS v3.1 base score of 9.3.

CVE-2026-65574 is an unauthenticated PHP Object Injection (deserialization of untrusted data) vulnerability in the AncoraThemes "Abogado" WordPress theme. It affects all versions up to and including 1.18 and carries a CVSS v3.1 base score of 9.8 (Critical). An unauthenticated, remote attacker can trigger deserialization of attacker-controlled data, potentially leading to full site compromise.

CVE-2026-65579 is an unauthenticated PHP Object Injection (deserialization of untrusted data, CWE-502) vulnerability in the Agricola WordPress theme by AxiomThemes. It affects Agricola versions up to and including 1.21.0 and carries a CVSS v3.1 base score of 9.8 (Critical). An unauthenticated, remote attacker can exploit it, potentially leading to full site compromise.

CVE-2026-16940 is a critical unauthenticated arbitrary file deletion vulnerability in the Custom Fields WordPress plugin in all versions before 1.5.1. The plugin fails to validate a user-supplied file path before deletion, allowing unauthenticated attackers to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover. It carries a maximum CVSS v3.1 base score of 10.0 (Critical).

CVE-2026-65571 is an unauthenticated PHP Object Injection vulnerability in the 69 Clothing WordPress theme (by Axiomthemes) affecting all versions up to and including 1.2.11.1. The flaw stems from deserialization of untrusted data (CWE-502) and is rated Critical with a CVSS v3.1 base score of 9.8.

CVE-2026-65546 is an unauthenticated SQL injection vulnerability in the Qode Tours WordPress plugin affecting all versions up to and including 3.1.3.1. An unauthenticated, remote attacker can inject malicious SQL into a database query, exposing sensitive data held by the WordPress site. It carries a CVSS v3.1 base score of 9.3 (Critical).

CVE-2026-65576 is an unauthenticated PHP Object Injection vulnerability in the Adrena WordPress theme by AncoraThemes, affecting all versions up to and including 1.2.14. The flaw stems from deserialization of untrusted data (CWE-502) and carries a CVSS v3.1 base score of 9.8 (Critical), allowing complete compromise of an affected site.

CVE-2026-66665 is an unauthenticated arbitrary file upload vulnerability in the Type Hub WordPress plugin (by Brandexponents) affecting all versions up to and including 2.0.6. Because unauthenticated attackers can upload files of dangerous types, the flaw can lead to full remote server compromise and carries a critical severity rating of 10.0.

CVE-2026-65581 is an unauthenticated PHP Object Injection vulnerability in the AI ANN WordPress theme (by Axiomthemes) in all versions up to and including 1.29.0. The flaw stems from deserialization of untrusted data and can be exploited over the network without authentication, earning a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-65556 is an unauthenticated PHP Object Injection vulnerability in the WPBruiser {no-Captcha anti-Spam} WordPress plugin (package goodbye-captcha) by MihChe, affecting all versions up to and including 3.1.43. The flaw stems from deserialization of untrusted data (CWE-502) and carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-65577 is an unauthenticated PHP Object Injection (insecure deserialization) vulnerability in the AncoraThemes "Advice" WordPress theme affecting all versions up to and including 1.18.0. It carries a CVSS v3.1 base score of 9.8 (Critical), as it can be exploited over the network without authentication or user interaction.