IONIX THREAT CENTER

CVE-2026-22068 is a high-severity Regular Expression without Anchors (CWE-777) vulnerability in Apache Traffic Server (ATS), a widely deployed internet-facing reverse proxy and caching server. Improperly anchored regular expressions in ATS's URL-mapping rules can be matched by specially crafted malicious domain names, allowing an unauthenticated remote attacker to bypass access controls and reach backend resources that should be restricted. The vulnerability carries a CVSS v3.1 score of 8.2 (High) and affects the 9.x and 10.x release branches.

CVE-2026-51077 is an SQL injection vulnerability (CWE-89) in DedeCMS version 5.7.118. A remote attacker can inject arbitrary SQL through the sqlquery parameter of the sys_sql_query.php component, allowing extraction of sensitive information from the backing database. The issue carries a CVSS v3.1 base score of 7.5 (HIGH) with a network attack vector.

CVE-2026-14924 is a Missing Authorization (CWE-862) vulnerability in the Tablesome Table WordPress plugin for versions before 1.1.31. One of the plugin's AJAX actions performs no authentication, capability, or nonce checks, allowing unauthenticated attackers to create new published posts and overwrite arbitrary existing posts and pages. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-65702 is a path traversal vulnerability (CWE-22) in Vanna (vanna-ai) through version 2.0.2, affecting the FileSystemConversationStore persistence integration. Unauthenticated remote attackers can supply path traversal sequences in the conversation_id parameter of the unauthenticated chat API endpoints to write attacker-controlled JSON files to arbitrary filesystem locations or read files outside the intended base directory. The vulnerability carries a CVSS v3.1 score of 8.6 (HIGH).

CVE-2026-12255 is a high-severity authentication bypass vulnerability (CWE-287: Improper Authentication) in the MainWP Child WordPress plugin, affecting all versions before 6.1.2. The flaw allows an unauthenticated remote attacker to obtain a fully valid authenticated session — including administrator-level access — by exploiting a missing identity verification step in the plugin's site-registration request handler. With over 700,000 active installations, the potential exposure across internet-facing WordPress sites is significant.

CVE-2026-12493 is a high-severity unauthenticated payment verification bypass affecting the Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin in all versions before 1.3.6. The flaw allows any unauthenticated attacker to mark arbitrary WooCommerce orders as paid by replaying a legitimately-approved payment reference — without paying the correct amount. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-13152 is a high-severity unauthenticated privilege escalation vulnerability in the Custom Fields Account Registration For WooCommerce WordPress plugin, affecting all versions before 1.4. By exploiting insufficient validation in how custom registration fields are saved to user metadata, an unauthenticated attacker can register an account and assign themselves the WordPress administrator role, resulting in full site takeover. The IONIX research team is tracking potentially affected assets and recommends immediate patching.

CVE-2026-66473 is a high-severity Broken Access Control vulnerability (CWE-862: Missing Authorization) affecting the Xendit Payment WooCommerce plugin (woo-xendit-virtual-accounts) for WordPress in all versions up to and including 7.1.0. The flaw allows unauthenticated remote attackers to invoke privileged plugin functionality without any credentials or user interaction, carrying a CVSS v3.1 base score of 7.5 (High). As of the publication date (July 27, 2026), no patched version has been released.

CVE-2026-13161 is a high-severity unauthenticated SQL injection vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, affecting all versions up to and including 1.2.2. Due to insufficient escaping of user-supplied input and improper SQL query preparation, unauthenticated remote attackers can inject arbitrary SQL commands via the alldata[truebooker_user] POST parameter to extract sensitive data from the WordPress database. The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH).

CVE-2026-14516 is a high-severity, unauthenticated time-based SQL Injection vulnerability in the Online Scheduling and Appointment Booking System – Bookly plugin for WordPress, affecting all versions up to and including 27.5. The flaw stems from insufficient escaping of user-supplied input and lack of proper SQL query preparation in the staff_ids parameter, enabling unauthenticated remote attackers to extract sensitive data from the underlying WordPress database. With a CVSS v3.1 base score of 7.5 (HIGH) and no authentication or user interaction required, all internet-exposed WordPress sites running a vulnerable version of Bookly are…

CVE-2026-12800 is a high-severity unauthenticated SQL injection vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin (wpdm-premium-packages), affecting all versions up to and including 6.2.0. The flaw allows any unauthenticated remote attacker to inject arbitrary SQL via the plugin's coupon REST API endpoint and extract sensitive data from the WordPress database. It carries a CVSS v3.1 base score of 7.5 (High).

CVE-2026-12741 is a high-severity unauthenticated SQL injection vulnerability affecting the WP Fast Total Search – The Power of Indexed Search WordPress plugin (all versions up to and including 1.80.280), developed by Epsiloncool. Due to insufficient escaping of user-supplied input and improper SQL query preparation, unauthenticated remote attackers can append malicious SQL statements to existing queries and extract sensitive data from the underlying WordPress database. The vulnerability carries a CVSS v3.1 base score of 7.5 (HIGH).

CVE-2026-64649 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in Next.js Server Actions, rated 8.3 (High) under CVSS 4.0. When a Server Action forwards or redirects a request, an unauthenticated attacker who can control Host-associated headers can cause the server to send that outbound request to an attacker-controlled host. In some configurations, the vulnerability also leaks internal values that can weaken middleware and proxy-based authorization controls.

CVE-2026-9830 is a high-severity authentication bypass vulnerability in the BookingPress Appointment Booking Pro WordPress plugin, affecting all versions prior to 5.7.3. The plugin fails to correctly invoke its REST API permission callback, leaving every route in one of its API namespaces accessible without authentication. With a CVSS v3.1 score of 8.2 (High), unauthenticated remote attackers can read sensitive customer booking data and modify other users' reservations without any credentials or user interaction.

CVE-2026-64642 is a high-severity authentication bypass vulnerability in Next.js, the widely deployed React web framework maintained by Vercel. Affecting versions 16.0.0 through 16.2.10, the flaw allows unauthenticated remote attackers to craft requests that completely bypass middleware- and proxy-based authentication in applications using the App Router with Turbopack and a single configured i18n locale. The issue was disclosed and patched as part of Vercel's July 21, 2026 security release, with a CVSS 4.0 score of 8.3 (High).

CVE-2026-64645 is a Server-Side Request Forgery (SSRF) and Open Redirect vulnerability in Next.js, the widely deployed React full-stack web framework maintained by Vercel. It affects versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, and carries a CVSS 4.0 score of 8.3 (High). When a rewrites() or redirects() configuration rule dynamically constructs an external destination hostname from attacker-controlled request input, the intended hostname suffix can be bypassed — enabling the Next.js server to be forced to proxy requests to any arbitrary host.

CVE-2025-15662 is a high-severity vulnerability affecting the Printcart Web to Print Product Designer for WooCommerce WordPress plugin in all versions prior to 2.5.3. The flaw combines two unauthenticated attack vectors — an Arbitrary Local File Read and Server-Side Request Forgery (SSRF) — arising from the plugin's failure to validate user-supplied URLs before performing server-side fetch operations. With a CVSS v3.1 score of 8.6 (High) and no authentication requirement, internet-exposed WooCommerce stores running this plugin are at immediate risk of credential theft and internal network reconnaissance.

CVE-2026-15810 is a reflected Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker affecting both Looker-hosted and self-hosted deployments. An unauthenticated attacker can craft a malicious URL that, when opened by a Looker administrator, executes arbitrary JavaScript in the administrator's session and results in full administrative account takeover. The vulnerability carries a CVSS v4.0 base score of 8.7 (HIGH) and was disclosed by Google on July 22, 2026.