IONIX THREAT CENTER

CVE-2026-75865 is a critical unauthenticated arbitrary file upload vulnerability in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode WordPress plugin (developed by wplegalpages, published under the gdpr-cookie-consent slug). The flaw allows unauthenticated attackers to upload arbitrary files — including malicious executable content — to a vulnerable site, which can lead to full remote code execution. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-82971 is a critical, unauthenticated OS command injection vulnerability in QVidium Opera11 firmware version 3.3.2a26-Ax4x-opera11. The flaw resides in the /cgi-bin/net_tr.cgi CGI script, where the ipaddr request parameter is passed to an underlying system call without proper sanitization, allowing a remote, unauthenticated attacker to execute arbitrary operating system commands on the device. The vulnerability has been assigned a maximum CVSS v3.1 base score of 10.0 (Critical), and public exploit code is reportedly available.

CVE-2026-81779 is a critical supply-chain backdoor vulnerability affecting the Newspapers X WordPress theme by Silk Themes. Versions 1.0.46 through 1.0.48 of the theme shipped with malicious code distributed through the vendor's official update channel, allowing unauthenticated remote attackers to gain persistent, unauthorized access to affected WordPress sites. The vulnerability carries a maximum CVSS v3.1 base score of 10.0 (Critical).

CVE-2026-82226 is an unauthenticated PHP Object Injection (Deserialization of Untrusted Data, CWE-502) vulnerability in the Tickera WordPress Event Ticketing System plugin, affecting all versions up to and including 3.6.0.2. The flaw allows a remote, unauthenticated attacker to submit crafted serialized data that the plugin unsafely deserializes, potentially leading to code execution, data manipulation, or other object-injection side effects. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-81763 is an unauthenticated SQL Injection vulnerability (CWE-89) affecting the Throws SPAM Away WordPress plugin in versions up to and including 3.8.2. The plugin fails to properly neutralize special SQL elements in attacker-supplied input, allowing blind SQL injection to be performed without any authentication. The flaw carries a Critical CVSS v3.1 base score of 9.3.

CVE-2026-81780 is a critical unauthenticated arbitrary file upload vulnerability in the Hash Form WordPress plugin (developed by hashthemes), affecting all versions up to and including 1.4.2. The flaw allows a remote, unauthenticated attacker to upload arbitrary files to the server, which can lead to remote code execution and full site compromise. It carries the maximum CVSS v3.1 base score of 10.0.

CVE-2026-81293 is an unauthenticated SQL Injection vulnerability (CWE-89) in the WP Data Access WordPress plugin, affecting all versions up to and including 5.5.81. The plugin fails to properly neutralize special elements in SQL statements, allowing a remote, unauthenticated attacker to inject arbitrary SQL and extract sensitive data from the site's database. The issue carries a Critical CVSS v3.1 score of 9.3.

CVE-2026-81756 is a critical, unauthenticated SQL Injection vulnerability (CWE-89) affecting the Smart Marketing SMS and Newsletters Forms WordPress plugin, developed by Autorius/E-goi. The flaw allows remote attackers to inject and execute SQL statements without any authentication or user interaction, and it carries a CVSS v3.1 base score of 9.3 (Critical).

CVE-2026-51730 is a critical incorrect access control vulnerability in the delWiFiAclRules function of the TOTOLINK T6 router's web management interface. It allows a remote, unauthenticated attacker to delete Wi-Fi Access Control List (ACL) rules on the device by sending a crafted request to the router's CGI endpoint, weakening the Wi-Fi access restrictions the device is supposed to enforce. It is rated CRITICAL with a CVSS v3.1 base score of 9.1.

CVE-2026-51725 is an improper/incorrect access control vulnerability in the NTPSyncWithHost function of the TOTOLINK T6 router web management interface, firmware version 4.1.5cu.748_B20211015. The function fails to enforce authentication, allowing an unauthenticated network attacker to send a crafted request to change the device's system clock. The issue carries a CVSS score of 9.1 (Critical).

CVE-2026-51681 is an incorrect access control vulnerability (CWE-284) in the setRemoteCfg function of the TOTOLINK T6 router web management interface, running firmware 4.1.5cu.748_B20211015. An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to expose and enable WAN-side administration on the device. The issue carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51720 is an incorrect access control vulnerability (CWE-284) in the delIpPortFilterRules function of the TOTOLINK T6 router's web management CGI handler. It allows a remote, unauthenticated attacker to delete configured firewall/port-filter rules by sending a crafted POST request, with no login or user interaction required. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-19286 is a critical remote code execution vulnerability in IBM Langflow OSS, caused by improper enforcement of security restrictions on the platform's A2A (Agent-to-Agent) public endpoint. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on affected instances. It carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51680 is an incorrect access control vulnerability (CWE-284) in the setLedCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to modify LED behavior on the device by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51679 is a critical improper access control vulnerability (CWE-284) in the setPasswordCfg function of the TOTOLINK T6 web management interface, firmware version 4.1.5cu.748_B20211015. It allows an unauthenticated, remote attacker to change the router's administrator account by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The issue carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-82970 is a critical Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the WP Legal Pages "WP Cookie Notice for GDPR, CCPA & ePrivacy Consent" WordPress plugin (package gdpr-cookie-consent). The flaw allows an unauthenticated attacker to upload malicious files to the plugin's file-upload functionality, and carries the maximum CVSS v3.1 base score of 10.0.

CVE-2026-66047 is a critical unauthenticated remote code execution vulnerability in the ProfilePress WordPress plugin (also distributed as "wp-user-avatar"). The plugin's ppress_connect_process AJAX handler lacks authentication and relies on a weak, brute-forceable 32-bit connect token, allowing unauthenticated attackers to install and activate arbitrary plugins and execute PHP code as the web-server user. All versions prior to 4.17.2 are affected.

CVE-2026-82695 is a critical missing-authentication vulnerability affecting the Telnet Handler component of Tenda AC18 wireless routers running firmware version 15.03.05.19. The flaw resides in the /goform/telnet endpoint, which fails to enforce any authentication check before processing requests, allowing a remote, unauthenticated attacker to trigger the handler over the network. The issue has been assigned a CVSS v3.1 base score of 10.0 (Critical), and a public proof-of-concept exploit is available.

CVE-2026-82694 is a missing authentication vulnerability in the Web UI of Tenda AC1206 firmware 15.03.06.23. The flaw resides in the R7WebsSecurityHandler function that handles requests to the /goform/ate endpoint, allowing a remote, unauthenticated attacker to invoke privileged device functionality without providing any credentials. The issue has been rated CRITICAL with a CVSS score of 10.0, and a public exploit is available.

CVE-2026-82693 is a missing authentication vulnerability in the Tenda AC1206 wireless router, affecting firmware version 15.03.06.23. The flaw resides in the TendaTelnet function of the /goform/telnet endpoint in the router's Web UI, allowing an attacker to invoke the endpoint without any credential verification. The issue carries a maximum CVSS score of 10.0 and a public exploit is available.