IONIX THREAT CENTER

CVE-2026-9282 is a high-severity Directory Traversal vulnerability in the W3 Total Cache WordPress plugin (by BoldGrid), affecting all versions up to and including 2.9.4. The flaw resides in the setupSources function and allows unauthenticated remote attackers to read the contents of arbitrary files on the server, with a CVSS v3.1 base score of 7.5 (HIGH). With over 900,000 active installations, the plugin represents a significant attack surface across the WordPress ecosystem.

CVE-2026-11404 is a high-severity out-of-bounds read vulnerability (CWE-125) in Cesanta Mongoose, a widely-deployed embedded C networking library used in IoT devices, industrial controllers, microcontrollers, and embedded appliances. The flaw resides in the built-in TLS server function mg_tls_server_recv_hello(), where an attacker-controlled session_id_len byte from a TLS ClientHello is used as a buffer index without bounds validation. A single crafted packet sent by a remote, unauthenticated attacker is sufficient to crash any HTTPS, MQTTS, or WSS service built on Mongoose's built-in TLS implementation, scoring CVSS 4.0 8.7 (HIGH).

CVE-2026-11571 is a high-severity sensitive information exposure vulnerability affecting the Everest Forms WordPress plugin in all versions prior to 3.5.0. The flaw stems from the plugin's failure to reliably delete temporary CSV files generated during email-notification processing, leaving those files publicly accessible in the WordPress uploads directory under predictable, enumerable paths. Any unauthenticated remote attacker can enumerate and download other users' form submission records containing personal and potentially sensitive data.

CVE-2026-15290 is a high-severity blind SQL injection vulnerability in the Ultimate Member WordPress plugin, affecting all versions up to and including 2.10.1. The flaw allows unauthenticated remote attackers to extract sensitive data from the WordPress database with no privileges and no user interaction required, earning a CVSS v3.1 score of 7.5. With over 200,000 active installations, the potential attack surface is significant.

CVE-2026-15291 is a high-severity sensitive information exposure vulnerability affecting the Chat Help – Click to Chat Button & Form WordPress plugin (by ThemeAtelier), in all versions up to and including 3.1.3. The flaw stems from missing authorization checks (CWE-862) on two REST API endpoints, allowing any unauthenticated, internet-accessible attacker to retrieve collected lead data including customer PII and WordPress account credentials. The vulnerability carries a CVSS v3.1 base score of 7.5 (HIGH) with a full confidentiality impact and no authentication requirement.

CVE-2026-59834 is a high-severity SQL injection vulnerability (CWE-89) in SiYuan, an open-source self-hosted personal knowledge management system. The flaw exists in the block search endpoint POST /api/search/fullTextSearchBlock, where user-supplied paths[] values are concatenated directly into SQL predicates, enabling an unauthenticated publish visitor to inject a UNION SELECT statement and exfiltrate content from documents that are hidden from public access. The issue is fixed in version 3.7.1, and all prior versions are affected.

CVE-2026-44787 is a high-severity privilege escalation vulnerability in Discourse, the open-source community discussion platform, affecting all versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. During the public account registration (signup) flow, a newly registering user can supply a crafted primary_group_id parameter to assign themselves membership in a whisper-enabled group, bypassing legitimate group enrollment entirely. On instances where the whispers_allowed_groups site setting is configured, this grants the unauthenticated attacker read and write access to whisper posts — private, restricted-visibility messages typically reserved for staff or privileged community members.

CVE-2026-55471 is a high-severity XML External Entity (XXE) injection vulnerability in HAPI FHIR's org.hl7.fhir.utilities library, affecting all versions prior to 6.9.10. The flaw resides in XsltUtilities.saxonTransform() overloads, which instantiate an unrestricted Saxon TransformerFactoryImpl and thereby allow an attacker who controls or can tamper with transformed XML to read arbitrary files from the server and conduct blind XXE/Server-Side Request Forgery (SSRF) attacks against internal and external URLs reachable from the host. The vulnerability carries a CVSS 3.1 base score of 8.6 (HIGH) and requires no authentication or user interaction.

CVE-2026-59731 is a high-severity authentication bypass vulnerability in the Astro web framework (withastro/astro), affecting version 6.4.7. The flaw stems from a URL canonicalization mismatch between middleware-level authorization logic and the rewrite route-matching stage, enabling unauthenticated remote attackers to access middleware-protected routes by supplying a sufficiently encoded URL path. It carries a CVSS v3.1 base score of 8.2 (High) and is classified under CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions).

CVE-2026-60105 is a high-severity server-side request forgery (SSRF) vulnerability affecting Monsta FTP in all versions before 2.14.5, published July 8, 2026 (CVSS v3.1: 8.6 HIGH). The flaw enables fully unauthenticated remote attackers to bypass the application's internal IP blocklist via IPv4-mapped IPv6 addresses and force the server to issue HTTP requests to internal services — including cloud instance metadata endpoints — with responses exfiltrated to an attacker-controlled FTP destination.

CVE-2026-59822 is a high-severity authentication bypass vulnerability in LiteLLM (AI Gateway/proxy server by BerriAI) affecting all versions prior to 1.84.0. The flaw resides in LiteLLM's MCP Streamable HTTP endpoint, where a faulty OAuth2 passthrough fallback mechanism allows an unauthenticated attacker to craft a fabricated Authorization header and gain access to MCP tooling without a valid LiteLLM key. The vulnerability carries a CVSS 4.0 score of 8.8 (High).

CVE-2026-12378 is a PHP Object Injection vulnerability affecting the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (by codepeople), in all versions through 1.1.28. The flaw arises from the plugin passing user-supplied data to a PHP deserialization function without any validation, allowing unauthenticated, network-based attackers to inject arbitrary PHP objects. Where a suitable gadget chain is available on the target site, this vulnerability can be leveraged to achieve Remote Code Execution (RCE).

CVE-2026-6230 is a time-based blind SQL injection vulnerability in the Tainacan plugin for WordPress, affecting all versions up to and including 1.0.3. The flaw resides in the plugin's geocoordinate query builder and is exploitable by unauthenticated, remote attackers via the geoquery parameter, requiring no privileges or user interaction. It carries a CVSS v3.1 base score of 7.5 (HIGH) and enables extraction of sensitive data from the underlying WordPress database.

CVE-2026-3144 is a high-severity authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.0.3, caused by the use of default credentials (CWE-1392) that the application does not enforce changing until after initial access has already been granted. An unauthenticated remote attacker can exploit this flaw to gain unauthorized access to the platform before the system triggers a mandatory credential update. The vulnerability carries a CVSS v3.1 base score of 8.1 (HIGH).

CVE-2026-44840 is a high-severity DQL (Dgraph Query Language) injection vulnerability in Dgraph, an open-source distributed GraphQL database, affecting all releases prior to version 25.3.4. The flaw allows unauthenticated remote attackers to inject arbitrary DQL query blocks through the checkUserPassword GraphQL query, enabling full exfiltration of database contents without any credentials. A patch is available in version 25.3.4.

CVE-2026-9700 is a high-severity, unauthenticated time-based SQL injection vulnerability in the Eventer WordPress plugin, affecting all versions up to and including 4.4.2. The flaw allows any remote, unauthenticated attacker to extract sensitive data from the underlying WordPress database with no privileges or user interaction required. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-55418 is a high-severity broken object-level authorization (IDOR) vulnerability in FastGPT, the open-source AI knowledge base and RAG platform developed by labring. Two file handler endpoints — the chat-file presign endpoint and the dataset preview endpoint — accept an S3 object key directly from the request without verifying that the key belongs to the requesting caller's team, enabling any unauthenticated network attacker to read files belonging to other tenants. The vulnerability carries a CVSS v3.1 score of 8.6 (HIGH) and requires no authentication, no privileges, and no user interaction to…

CVE-2026-59708 is a Missing Authorization vulnerability (CWE-862) in Ghostfolio, an open-source self-hosted wealth management web application built with Angular, NestJS, and Prisma. The flaw exists in the GET /api/v1/public/:accessId/portfolio endpoint, which fails to enforce granteeUserId filtering, allowing unauthenticated access to private portfolio data when a private access ID is known. The CVSS 4.0 score is 8.7 (HIGH) and CVSS 3.1 score is 7.5 (HIGH), reflecting a fully network-accessible, unauthenticated, high-confidentiality-impact vulnerability.

CVE-2026-12277 is a high-severity unauthenticated arbitrary file deletion vulnerability in the Frontend File Manager Plugin for WordPress, affecting all versions through 23.6, with a CVSS v3.1 score of 8.7. The flaw allows unauthenticated, network-based attackers to delete any file on the server — including WordPress's critical configuration file wp-config.php — when the plugin's guest upload mode is enabled. Deleting wp-config.php forces the WordPress installation wizard to relaunch, which an attacker can exploit to achieve full site takeover.

CVE-2026-58656 is a high-severity vulnerability in the Grav CMS API plugin (getgrav/grav-plugin-api) affecting all versions before v1.0.0-rc.16, carrying a CVSS 4.0 score of 8.7 (High). The flaw combines two compounding weaknesses — the plugin exposes JWT authentication tokens via the ?token= URL query parameter, leaking credentials into server access logs, browser history, and HTTP Referrer headers; and every API response includes a wildcard Access-Control-Allow-Origin: * header, permitting any website to read authenticated API responses from a browser context. An attacker who obtains a leaked JWT token through any of these…