The Events Calendar CVE-2026-95606 is a critical security vulnerability affecting the popular The Events Calendar WordPress plugin. The vulnerability allows unauthenticated attackers to inject malicious PHP objects through the unsafe deserialization of untrusted data. With a CVSS score of 9.8 and more than 600,000 active plugin installations, this security issue deserves immediate attention from WordPress administrators. All versions up to and including 6.17.4 are affected. The vulnerability has been fixed in version 6.17.4.1.

Depending on the additional plugins and themes installed on an affected website, successful exploitation could potentially lead to sensitive information disclosure, unauthorized file operations, or remote code execution.

Security researchers disclosed the vulnerability on October 2, 2026. The corresponding CVE record was published on October 7, 2026.

What Is The Events Calendar CVE-2026-95606?

The Events Calendar CVE-2026-95606 is a PHP Object Injection vulnerability caused by the unsafe deserialization of untrusted data.

The Events Calendar is a widely used WordPress plugin that allows website administrators to create and manage events, calendars, venues, and event organizers.

Businesses, educational institutions, municipalities, associations, and other organizations frequently use the plugin to publish events and manage public calendars.

The vulnerability occurs when the plugin processes certain serialized PHP data without sufficient validation.

PHP serialization allows application data and objects to be converted into a format that can be stored or transferred.

Deserialization reconstructs that information into PHP values and objects.

When an application deserializes untrusted data, an attacker may be able to influence which PHP objects are created and how they behave.

This security weakness is classified as CWE-502: Deserialization of Untrusted Data.

How Does the PHP Object Injection Vulnerability Work?

The vulnerability allows an unauthenticated attacker to introduce a PHP object into the affected application’s processing flow.

PHP objects may contain special methods that execute automatically during certain operations, such as object destruction or deserialization.

Under specific conditions, attackers can combine these behaviors into a sequence known as a PHP Object Injection gadget chain.

Such a chain may cause the application to perform unintended operations.

The actual impact depends on which PHP classes and methods are available within the affected WordPress environment.

According to the published vulnerability information, The Events Calendar itself does not contain a known exploitable Property-Oriented Programming (POP) chain for this vulnerability.

However, other installed WordPress plugins or themes may provide a suitable gadget chain.

If such a chain exists, an attacker may be able to perform more serious actions.

What Are the Potential Security Consequences?

The Events Calendar CVE-2026-95606 has been assigned a critical CVSS 3.1 score of 9.8 by Patchstack.

The vulnerability can be triggered without authentication or interaction from an existing WordPress user.

Depending on the available gadget chains, possible consequences include:

• Sensitive information disclosure: unauthorized access to files or application data.
• Arbitrary file deletion: removal of files accessible to the affected PHP process.
• Unauthorized file operations: manipulation of application files under certain conditions.
• Remote Code Execution: execution of attacker-controlled code if a suitable gadget chain is available.
• Website compromise: further unauthorized activity within the affected WordPress environment.

Important: The presence of a PHP Object Injection vulnerability does not automatically mean that arbitrary code execution is possible on every affected website.

The consequences depend on the installed software and the availability of a suitable gadget chain.

Which Versions of The Events Calendar Are Vulnerable?

The following vulnerability details have been confirmed by Patchstack and the National Vulnerability Database:

• Plugin: The Events Calendar.
• Developer: Liquid Web / StellarWP.
• CVE identifier: CVE-2026-95606.
• Affected versions: 6.17.4 and earlier.
• First patched version: 6.17.4.1.
• Recommended version: The latest compatible release, at least 6.17.4.1.
• CVSS score: 9.8 – Critical, according to Patchstack.
• Authentication required: No.
• Vulnerability type: PHP Object Injection.
• CWE classification: CWE-502.

Administrators running version 6.17.4 or an earlier release should update the plugin immediately.

The developer addressed the underlying issue by strengthening validation of copied widget instance data.

Are All 600,000 WordPress Installations Vulnerable?

The Events Calendar has more than 600,000 active installations according to WordPress plugin statistics.

However, this figure represents the total number of active installations, not the number of websites currently running vulnerable versions.

Installations that have already updated to version 6.17.4.1 or later are protected against this specific vulnerability.

Furthermore, the ability to achieve serious consequences such as remote code execution depends on the presence of a suitable PHP gadget chain.

Nevertheless, administrators should treat all affected plugin versions as requiring a security update.

Is CVE-2026-95606 Being Actively Exploited?

As of October 14, 2026, there is no independently confirmed evidence of active exploitation specifically targeting CVE-2026-95606.

Patchstack classifies the vulnerability as high priority and warns that vulnerabilities of this type may be attractive to attackers.

However, a high severity rating or an expectation of future exploitation should not be interpreted as confirmation that attacks are already occurring.

The vulnerability is publicly documented, and a security update is available.

Vservs therefore recommends updating affected installations without unnecessary delay.

How to Check Whether Your WordPress Website Is Vulnerable

Website administrators can check whether their installation is affected by The Events Calendar CVE-2026-95606 through the WordPress dashboard.

Log in to WordPress and navigate to Plugins → Installed Plugins.

Locate The Events Calendar and check the installed version.

If version 6.17.4 or earlier is installed, the website is running a version affected by this vulnerability.

Update to version 6.17.4.1 or later.

Administrators with SSH access can also check the installed version using WP-CLI.

Run the following command from the WordPress installation directory:

wp plugin get the-events-calendar --field=version

This command displays the installed plugin version.

To update The Events Calendar using WP-CLI, execute:

wp plugin update the-events-calendar

After completing the update, verify the installed version:

wp plugin get the-events-calendar --field=version

The installed version should be 6.17.4.1 or newer.

What Should WordPress Administrators Do?

Vservs recommends the following security measures:

1. Identify WordPress websites using The Events Calendar.
2. Check the currently installed plugin version.
3. Update immediately to version 6.17.4.1 or later.
4. Prefer the latest compatible release where possible.
5. Verify that calendar pages, event listings, and event registration functionality continue working correctly.
6. Review other installed plugins and themes for known vulnerabilities.
7. Remove unused plugins and themes.
8. Review WordPress user accounts and administrative permissions.
9. Monitor application and server logs for suspicious activity.

Organizations managing multiple WordPress installations should prioritize identifying outdated copies of The Events Calendar across their hosting environments.

If an immediate update is not possible, temporarily disabling the affected plugin can prevent exploitation through its vulnerable functionality.

This may affect public event listings and other calendar features.

How to Check for Possible WordPress Compromise

Installing the security update prevents exploitation through the corrected vulnerability but does not automatically remove malicious files or unauthorized modifications that may already exist.

Administrators should therefore investigate potentially vulnerable installations for suspicious activity.

Recommended checks include:

• Review web server access logs for unusual requests targeting WordPress functionality.
• Investigate unexpected serialized PHP object data in suspicious requests.
• Check for unauthorized changes to WordPress core files, plugins, and themes.
• Inspect writable directories for unexpected PHP files.
• Review administrator accounts for unauthorized additions.
• Investigate unexpected scheduled tasks or cron jobs.
• Monitor unusual outbound network connections.
• Check application logs for unexpected PHP errors or abnormal behavior.

These checks are general indicators of possible compromise rather than confirmed indicators of exploitation specific to CVE-2026-95606.

The presence of serialized data or unusual requests does not automatically establish that an attack was successful.

If a compromise is suspected, preserve relevant logs and evidence before performing extensive cleanup.

Why PHP Object Injection Is Dangerous for WordPress

WordPress websites often depend on multiple third-party plugins and themes.

Each additional component introduces PHP classes, methods, and application functionality.

Although these components may be secure when used independently, combinations of available functionality can sometimes create unexpected security risks.

PHP Object Injection vulnerabilities are particularly concerning because attackers may attempt to use functionality from unrelated plugins or themes.

This means that the security impact of a vulnerability may depend on the complete WordPress environment rather than a single plugin.

Keeping all installed components updated is therefore essential.

Administrators should also limit unnecessary PHP functionality, remove unused extensions, and maintain appropriate file permissions.

Managed WordPress Hosting Infrastructure at Vservs

Vservs provides professionally managed hosting infrastructure for businesses, agencies, and organizations operating WordPress websites.

Our Managed VPS Servers provide a professionally maintained server environment with operating system security updates, monitoring, and infrastructure management.

For WordPress websites, application-level security remains equally important.

WordPress core, plugins, and themes must be updated regularly to address newly discovered vulnerabilities.

Combining timely application updates with a maintained hosting environment helps reduce security exposure and supports reliable website operations.

Conclusion

The Events Calendar CVE-2026-95606 is a critical PHP Object Injection vulnerability affecting plugin versions up to and including 6.17.4.

The vulnerability can be triggered without authentication and may lead to serious consequences when a suitable PHP gadget chain is available.

Although active exploitation of this specific vulnerability has not been confirmed, the CVSS score of 9.8 and the plugin’s widespread use make timely remediation important.

WordPress administrators should update The Events Calendar to version 6.17.4.1 or later and review their installations for other outdated or vulnerable components.

Sources

• Patchstack – CVE-2026-95606 Vulnerability Details
• NIST National Vulnerability Database – CVE-2026-95606
• WordPress.org – The Events Calendar Plugin and Changelog
• WPScan – The Events Calendar Security Vulnerabilities

Click to Chat CVE-2026-92097 is a security vulnerability affecting the popular Click to Chat – HoliThemes WordPress plugin, which has more than 600,000 active installations. The vulnerability allows unauthenticated attackers to execute registered WordPress shortcodes under specific conditions. Plugin versions up to and including 4.44 are affected. The developer has addressed the issue in version 4.45, and website administrators are advised to update their installations promptly.

The vulnerability was publicly disclosed on October 13, 2026. Depending on the configuration of the affected website and the shortcodes available through other installed plugins or themes, successful exploitation could result in unauthorized application actions or the disclosure of sensitive information.

What Is Click to Chat CVE-2026-92097?

Click to Chat is a widely used WordPress plugin developed by HoliThemes. It allows website visitors to contact businesses directly through WhatsApp using configurable chat buttons, greeting messages, and predefined responses.

The plugin is particularly popular among business websites, online stores, and organizations that provide customer support through WhatsApp.

Security researchers discovered that certain greeting templates improperly process user-controlled URL information before passing it to WordPress shortcode execution functions.

The vulnerability is tracked as CVE-2026-92097 and involves insufficient filtering of shortcode delimiters in data originating from HTTP requests.

Because the affected functionality can be accessed without authentication, an external attacker may be able to trigger shortcode execution without having a WordPress account.

How Does the Vulnerability Work?

The vulnerability originates from the way Click to Chat processes the {url} placeholder within certain greeting messages.

On archive pages, the plugin retrieves information from the requested URL and inserts it into the greeting content.

The affected code uses the WordPress function sanitize_text_field() to process the request URI. However, this function does not remove all characters that can be interpreted as WordPress shortcode syntax.

The resulting content is subsequently passed to the WordPress do_shortcode() function.

Under specific circumstances, an attacker can supply specially crafted URL content containing shortcode instructions.

These instructions may then be interpreted as registered WordPress shortcodes rather than displayed as ordinary text.

The issue affects the Greetings-1 and Greetings-2 templates when the vulnerable URL placeholder is used in the relevant greeting content.

What Are the Potential Security Risks?

The direct consequence of Click to Chat CVE-2026-92097 is unauthorized execution of registered WordPress shortcodes.

The actual security impact depends on the shortcodes available within the affected WordPress installation.

WordPress plugins and themes can register custom shortcodes that perform different operations, including displaying content, processing forms, or interacting with application data.

If an installed component exposes a shortcode with insufficient authorization checks, an attacker may be able to abuse that functionality.

Potential consequences include:

• Unauthorized execution of registered WordPress shortcodes.
• Exposure of information through insecure shortcode functionality.
• Unexpected execution of application features provided by other plugins.
• Manipulation of website content or application behavior.
• Further security consequences when vulnerable shortcodes are available.

Important: Arbitrary shortcode execution does not automatically mean that an attacker can execute arbitrary PHP code on every affected website.

The severity of a successful attack depends on the available shortcode functionality and the configuration of the WordPress environment.

Which Click to Chat Versions Are Affected?

The following vulnerability details have been confirmed:

• Plugin: Click to Chat – HoliThemes.
• CVE identifier: CVE-2026-92097.
• Affected versions: 4.44 and earlier.
• First patched version: 4.45.
• Wordfence CVSS score: 9.1 – Critical.
• Patchstack CVSS score: 5.3 – Medium.
• Authentication required: No.
• Public disclosure: October 13, 2026.

The difference between the Wordfence and Patchstack severity ratings reflects different assessments of the potential consequences of arbitrary shortcode execution.

Both security databases confirm that version 4.45 addresses the vulnerability.

Are All 600,000 WordPress Websites Vulnerable?

No. The figure of more than 600,000 represents the total number of active Click to Chat installations, not the number of confirmed vulnerable websites.

Successful exploitation requires specific conditions involving the affected greeting templates and the processing of the {url} placeholder.

Websites using a vulnerable plugin version with an enabled greeting dialog containing the affected placeholder may be exposed.

Installations that do not use the vulnerable functionality may not provide the same attack path.

However, administrators should not rely on configuration alone as a permanent security measure.

Updating to version 4.45 or later is the recommended solution.

Is CVE-2026-92097 Being Actively Exploited?

As of October 14, 2026, there is no confirmed evidence that CVE-2026-92097 is being actively exploited in attacks against WordPress websites.

The vulnerability has been publicly disclosed, and technical details describing the affected functionality are available.

Although active exploitation has not been confirmed, the large number of installations makes the vulnerability relevant to website administrators and hosting providers.

Organizations should therefore apply the available security update without unnecessary delay.

How to Check Whether Click to Chat Is Vulnerable

Website administrators can check whether their WordPress installation is affected by Click to Chat CVE-2026-92097 through the WordPress dashboard.

Log in to WordPress and navigate to Plugins → Installed Plugins.

Locate Click to Chat – HoliThemes and check the installed version.

If version 4.44 or earlier is installed, update the plugin to version 4.45 or later.

Administrators with SSH access can also check the installed version using WP-CLI.

Run the following command from the WordPress installation directory:

wp plugin get click-to-chat-for-whatsapp --field=version

This command displays the currently installed plugin version.

To update the plugin using WP-CLI, execute:

wp plugin update click-to-chat-for-whatsapp

After completing the update, verify that the installed version is at least 4.45.

What Should WordPress Administrators Do?

Vservs recommends the following security measures:

1. Identify WordPress websites using Click to Chat – HoliThemes.
2. Check whether the installed plugin version is 4.44 or earlier.
3. Update the plugin to version 4.45 or later.
4. Review the configuration of the Greetings-1 and Greetings-2 templates.
5. Check whether the {url} placeholder is used in greeting messages.
6. Test WhatsApp chat buttons, greeting dialogs, and predefined messages after updating.
7. Review other installed WordPress plugins and themes for known vulnerabilities.
8. Monitor website and server logs for suspicious activity.

Where an immediate update is not possible, administrators can temporarily disable the affected greeting functionality or remove the {url} placeholder from greeting messages.

These measures may reduce exposure but should not be considered a permanent replacement for installing the security update.

How to Check for Possible Compromise

Administrators operating previously vulnerable versions should review their websites for unusual activity.

Because the vulnerability involves user-controlled URL data and shortcode execution, web server logs may contain suspicious requests with unexpected shortcode-like content.

Recommended checks include:

• Review access logs for unusual requests to WordPress archive pages.
• Investigate unexpected shortcode syntax in URL paths or query parameters.
• Check for unusual URL encoding or repeated requests containing square brackets.
• Review WordPress administrator accounts for unauthorized additions.
• Inspect application settings for unexpected modifications.
• Check website files for unauthorized changes.
• Investigate unexpected application behavior or suspicious server activity.

These are general investigation recommendations and not confirmed indicators of exploitation specific to CVE-2026-92097.

The presence of unusual URL parameters alone does not establish that an attack was successful.

If compromise is suspected, preserve relevant logs and investigate the affected environment before performing extensive cleanup.

Why WordPress Plugin Security Matters

WordPress websites frequently depend on multiple third-party plugins for communication, e-commerce, forms, analytics, and other business functions.

Even plugins that appear to provide relatively simple functionality can introduce security risks when user-controlled data is processed incorrectly.

The Click to Chat vulnerability demonstrates how a weakness in input handling can interact with functionality provided by other installed WordPress components.

Maintaining updated plugins and themes is therefore an essential part of WordPress security.

Administrators should also remove unused extensions, review user permissions, and ensure that the underlying hosting environment receives regular security updates.

Managed WordPress Hosting Infrastructure at Vservs

Vservs provides professionally managed hosting infrastructure for businesses, agencies, and organizations operating WordPress websites.

Our Managed VPS Servers provide a maintained server environment with operating system updates, security maintenance, monitoring, and infrastructure management.

For organizations requiring additional WordPress management, keeping the WordPress application, plugins, and themes updated remains an important part of reducing security exposure.

A secure hosting environment combined with timely application updates helps protect business websites against known vulnerabilities.

Conclusion

Click to Chat CVE-2026-92097 is a security vulnerability affecting plugin versions up to and including 4.44.

Under specific conditions, unauthenticated attackers can execute registered WordPress shortcodes through vulnerable greeting functionality.

With more than 600,000 active installations, Click to Chat is widely deployed across WordPress websites.

Although active exploitation has not been confirmed, administrators should update to version 4.45 or later and review the configuration of their greeting dialogs.

Sources

• Patchstack – CVE-2026-92097 Vulnerability Details
• Wordfence Intelligence – Click to Chat Arbitrary Shortcode Execution
• WordPress.org – Click to Chat Plugin and Changelog
• Rapid7 – CVE-2026-92097 Technical Details

Magento vulnerability CVE-2026-103849 is a critical security flaw affecting Adobe Commerce and Magento Open Source, with a maximum CVSS score of 10.0. On October 13, 2026, Adobe released security bulletin APSB26-153, addressing eleven vulnerabilities across its e-commerce platforms. The most severe vulnerability could allow unauthenticated attackers to execute arbitrary code. Organizations operating Magento or Adobe Commerce stores should review their installations and apply the appropriate October 2026 security patches immediately.

Five of the eleven vulnerabilities are classified as critical. Depending on the vulnerability, successful exploitation could result in remote code execution, privilege escalation, unauthorized file modifications, or the bypassing of important security controls.

What Is Magento Vulnerability CVE-2026-103849?

Magento vulnerability CVE-2026-103849 is caused by improper neutralization of special elements used within a template engine, classified as CWE-1336.

This vulnerability can allow an attacker to manipulate template processing and potentially execute arbitrary code within the affected application environment.

Adobe has assigned the vulnerability the maximum CVSS 3.1 score of 10.0.

According to Adobe, exploitation does not require authentication or user interaction. The vulnerability is remotely exploitable over the network and has a low attack complexity rating.

These characteristics make the vulnerability particularly serious for publicly accessible e-commerce environments.

A successful attack could potentially compromise the confidentiality, integrity, and availability of an affected Magento installation.

Eleven Security Vulnerabilities Fixed in Adobe Commerce

Adobe Security Bulletin APSB26-153 addresses eleven vulnerabilities affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.

The five critical vulnerabilities are:

• CVE-2026-103849 – CVSS 10.0: Improper template engine neutralization potentially allowing arbitrary code execution without authentication.
• CVE-2026-92909 – CVSS 9.8: Incorrect authorization in Adobe Commerce B2B potentially allowing unauthenticated arbitrary code execution.
• CVE-2026-91013 – CVSS 9.3: Stored Cross-Site Scripting (XSS) potentially resulting in privilege escalation.
• CVE-2026-100133 – CVSS 9.3: Stored Cross-Site Scripting (XSS) potentially resulting in privilege escalation.
• CVE-2026-92464 – CVSS 9.1: Improper input validation potentially allowing arbitrary code execution. Exploitation requires an authenticated attacker with elevated privileges.

The remaining vulnerabilities include five high-severity issues and one medium-severity issue.

These additional vulnerabilities involve security feature bypasses, unauthorized file system modifications, stored XSS, and other security weaknesses.

Which Magento and Adobe Commerce Versions Are Affected?

According to Adobe, the following product branches are affected by APSB26-153:

• Adobe Commerce 2.4.4 through 2.4.9, including the September 2026 security patch levels and earlier releases.
• Magento Open Source 2.4.6 through 2.4.9, including the September 2026 security patch levels and earlier releases.
• Adobe Commerce B2B 1.3.3 through 1.5.3, within the supported affected release branches.

Administrators should verify the exact installed version and patch level rather than relying solely on the main Magento version number.

A store running a supported release may still be vulnerable if the required security patches have not been installed.

Which Magento Versions Are Secure?

Adobe has published October 2026 security patch levels for supported Adobe Commerce and Magento Open Source branches.

For Magento Open Source, the corrected security levels include:

• Magento Open Source 2.4.7-2026-oct
• Magento Open Source 2.4.8-2026-oct
• Magento Open Source 2.4.9-2026-oct

For Adobe Commerce, corrected October 2026 security levels are available for branches 2.4.4 through 2.4.9.

Adobe Commerce B2B also has corresponding October security updates for its supported release branches.

Important: The October 2026 security fixes are distributed as isolated security patches rather than new standard Composer packages.

Administrators must apply the appropriate isolated patch for their installed version and ensure that all required earlier patches are present.

Magento Open Source installations running version 2.4.6 should review their upgrade path because Adobe does not list a new October 2026 security level for that Open Source branch.

Are These Magento Vulnerabilities Being Actively Exploited?

As of October 14, 2026, Adobe has stated that it is not aware of active exploitation of any of the eleven vulnerabilities addressed in APSB26-153.

However, the absence of confirmed exploitation does not mean that affected installations are safe.

The technical severity of CVE-2026-103849 makes prompt remediation particularly important.

Organizations should also be aware of the previously disclosed Magento vulnerability CVE-2026-75650.

Adobe explicitly states that the separate hotfix for CVE-2026-75650 must still be applied in addition to the October 2026 security patches.

Installing the October updates alone does not replace this earlier hotfix requirement.

How to Protect Magento and Adobe Commerce Installations

Vservs recommends that Magento administrators take the following actions:

1. Identify the exact Adobe Commerce or Magento Open Source version currently installed.
2. Review the existing security patch level.
3. Download the appropriate October 2026 isolated security patch from Adobe.
4. Verify that all required previous isolated patches have been installed.
5. Apply the October security patch according to Adobe’s installation instructions.
6. Confirm that the separate CVE-2026-75650 hotfix is installed.
7. Test checkout functionality, payment integrations, extensions, and administrative features.
8. Rotate encryption keys and associated credentials as recommended by Adobe.
9. Monitor application and server logs for suspicious activity.

For Adobe Commerce installations running on cloud infrastructure, administrators should check whether the latest Magento Cloud Patches update already includes the required fixes.

Applying an isolated patch when the fix is already present through Cloud Patches can cause installation failures.

How to Check Magento Security Patch Status

Magento administrators with command-line access can inspect the current application version and available security patch information.

From the Magento installation directory, the installed application version can be checked using:

php bin/magento --version

Where Adobe’s Commerce Version Tool is installed, patch status can also be checked using:

php vendor/bin/patch-status

The patch-status command is only available when the corresponding Adobe tool has been installed.

Administrators should compare the results with Adobe’s official APSB26-153 security bulletin and the applicable October patch documentation.

For production environments, patches should preferably be tested in a staging environment before deployment.

Check for Signs of Magento Compromise

Applying a security patch prevents exploitation of the corrected vulnerability but does not automatically remove malicious files or unauthorized changes that may already exist.

Administrators should therefore investigate potentially vulnerable installations for signs of compromise.

Recommended checks include:

• Review Magento administrator accounts for unknown users or unexpected permission changes.
• Inspect application files for unauthorized modifications.
• Check writable directories, including pub/media, for unexpected PHP files.
• Review API integrations and access tokens for unauthorized activity.
• Investigate unusual POST requests and suspicious patterns in web server access logs.
• Check scheduled tasks and cron jobs for unauthorized modifications.
• Monitor outbound network connections for unexpected destinations.
• Review payment integrations and checkout pages for unauthorized JavaScript modifications.

These checks are general compromise indicators and are not specific confirmed indicators of exploitation for CVE-2026-103849.

If a compromise is suspected, administrators should preserve relevant logs and evidence before attempting extensive cleanup.

Why Magento Server Security Matters

Magento and Adobe Commerce are complex e-commerce platforms that depend on several underlying software components.

In addition to application security patches, organizations must maintain the operating system, PHP runtime, database server, web server, and supporting services.

Weak access controls, outdated software, and insufficient monitoring can increase the impact of an application-level vulnerability.

A properly maintained hosting environment helps reduce unnecessary exposure and provides better visibility into suspicious activity.

Managed Magento Hosting Infrastructure at Vservs

Vservs provides professional hosting infrastructure for businesses operating Magento, Adobe Commerce, and other demanding e-commerce applications.

Our Managed VPS Servers provide a professionally managed server environment with operating system maintenance, security updates, monitoring, and infrastructure management.

Application-level security remains important. Magento administrators must ensure that the appropriate application patches, extensions, and security fixes are installed.

Combining a maintained hosting infrastructure with timely Magento updates helps organizations reduce security risks and maintain a stable online shopping environment.

Conclusion

Magento vulnerability CVE-2026-103849 represents a serious security risk due to its maximum CVSS score of 10.0 and the possibility of unauthenticated arbitrary code execution.

Adobe’s October 2026 security bulletin addresses eleven vulnerabilities, including five critical issues.

Although Adobe has not confirmed active exploitation of these newly disclosed vulnerabilities, affected organizations should install the appropriate security patches without unnecessary delay.

Administrators must also verify that the separate hotfix for CVE-2026-75650 remains installed.

Sources

• Adobe Security Bulletin APSB26-153 – October 13, 2026
• Adobe Experience League – October 2026 Security Patches and Installation Instructions
• Tenable – CVE-2026-103849 Vulnerability Details

Ghostscript CVE-2026-39919 is a critical security vulnerability that can allow remote code execution when a Linux server processes a specially crafted PDF document. Security researchers at Wordfence have demonstrated successful exploitation in a controlled WordPress environment.

The vulnerability affects Ghostscript, a widely used PDF and PostScript processing application. Ghostscript is commonly used by other software, including ImageMagick, to convert PDF documents into images and generate document previews.

CVE-2026-39919 has a CVSS 3.1 score of 9.8 Critical. The vulnerability has been fixed in upstream Ghostscript 10.08.0, released on September 8, 2026. However, the availability of security updates depends on the Linux distribution and package version.

What is Ghostscript CVE-2026-39919?

Ghostscript is an open-source interpreter for PDF and PostScript documents. It is widely used on Linux servers for document conversion, printing and image processing.

Many applications use Ghostscript indirectly through other software components.

For example, WordPress can use PHP Imagick and ImageMagick to generate preview images from uploaded PDF documents.

Depending on the server configuration, this process can invoke Ghostscript to render the PDF.

CVE-2026-39919 is a heap-based buffer overflow vulnerability in Ghostscript’s JPEG 2000 image processing.

The vulnerability occurs when specially crafted JPEG 2000 image data contains inconsistent component subsampling information.

Under the affected conditions, Ghostscript can write data beyond the boundaries of an allocated memory buffer.

This can cause memory corruption and potentially allow an attacker to execute arbitrary code.

How does the Ghostscript vulnerability work?

The vulnerability affects the JPEG 2000 output adapter within Ghostscript.

The affected source file is:

base/sjpx_openjpeg.c

When processing certain JPEG 2000 image components, Ghostscript incorrectly calculates the amount of memory required for an output buffer.

A specially crafted PDF can exploit this condition by including JPEG 2000 image data with mismatched subsampling factors.

Under the vulnerable conditions, the software may write more data than the allocated buffer can safely contain.

This results in heap memory corruption.

Depending on the operating system, memory layout and available exploit mitigations, the result may range from a process crash to arbitrary code execution.

Which Ghostscript versions are vulnerable?

According to the published vulnerability information, the following upstream Ghostscript versions are affected:

• Software: Artifex Ghostscript
• CVE: CVE-2026-39919
• Vulnerability: Heap-based buffer overflow
• Affected upstream versions: Ghostscript 9.21 through 10.07.1
• First patched upstream version: Ghostscript 10.08.0
• CVSS 3.1: 9.8 Critical
• Potential impact: Remote Code Execution
• Active exploitation: Not confirmed

Important: Linux distributions frequently backport security fixes into older software versions.

A Ghostscript version number lower than 10.08.0 does not automatically mean that the installed package remains vulnerable.

Administrators should verify the complete distribution package version against the official security advisory for their operating system.

Can malicious PDF uploads compromise WordPress websites?

Under specific conditions, yes.

Wordfence demonstrated that a specially crafted PDF could lead to unauthenticated Remote Code Execution on a purpose-built WordPress test website.

The demonstrated attack required a particular combination of application functionality and server configuration.

The relevant conditions include:

• The website accepts PDF uploads from untrusted visitors or users with limited privileges.
• Uploaded PDF documents are automatically processed or converted into preview images.
• The document conversion process invokes a vulnerable Ghostscript installation.
• The attacker can reach the affected upload and processing functionality.

A standard WordPress installation does not automatically allow anonymous visitors to upload arbitrary PDF documents to the media library.

However, additional WordPress plugins, public forms, membership functionality or custom applications may provide document upload capabilities.

When these components automatically process uploaded PDF files, they can potentially expose the underlying Ghostscript vulnerability.

Why is this vulnerability relevant to hosting providers?

Unlike a typical WordPress plugin vulnerability, CVE-2026-39919 affects software installed at the operating-system level.

Multiple websites and applications on the same hosting server may therefore depend on the same Ghostscript installation.

Potentially affected environments include:

• WordPress websites generating PDF thumbnails;
• document management systems;
• customer portals accepting PDF uploads;
• applications converting PDF files into images;
• hosting environments using ImageMagick or PHP Imagick;
• custom web applications processing externally supplied documents.

The presence of Ghostscript alone does not prove that a server is remotely exploitable.

The actual risk depends on whether untrusted documents can reach the vulnerable processing functionality.

Debian 12 and Debian 13 security status

Linux administrators should pay particular attention to the security status of their distribution packages.

As of October 13, 2026, the Debian Security Tracker reports the following status for CVE-2026-39919:

• Debian 12 Bookworm: Ghostscript 10.0.0~dfsg-11+deb12u8 is still listed as vulnerable.
• Debian 13 Trixie: Security updates are available.
• Debian 13 first patched package: 10.05.1~dfsg-1+deb13u2.
• Debian 13 current security package: 10.05.1~dfsg-1+deb13u3.

The Debian 13 security package contains the necessary correction for CVE-2026-39919.

Administrators using Debian 12 should monitor the official Debian Security Tracker for an applicable security update.

Until a fix is available, systems that process untrusted PDF documents should implement appropriate temporary risk-reduction measures.

Ubuntu security updates are available

Canonical has also published security updates addressing CVE-2026-39919.

Ubuntu Security Notice USN-8791-1 provides corrected packages for supported Ubuntu releases.

These include:

• Ubuntu 22.04 LTS: Ghostscript 9.55.0~dfsg1-0ubuntu5.14.
• Ubuntu 24.04 LTS: Ghostscript 10.02.1~dfsg1-0ubuntu7.9.
• Ubuntu 26.04 LTS: Ghostscript 10.06.0~dfsg-3ubuntu1.1.

These distribution-specific versions include backported security fixes, even though their upstream version numbers are lower than Ghostscript 10.08.0.

How to check Ghostscript on a Linux server

Linux administrators can check whether Ghostscript is installed with:

command -v gs

The installed Ghostscript version can be displayed using:

gs --version

On Debian and Ubuntu, the complete package version can be checked with:

dpkg-query -W ghostscript

Administrators can also check the available package versions with:

apt-cache policy ghostscript

The complete package version should always be compared with the security information published by the Linux distribution.

Container environments and manually compiled installations should be checked separately, because they may contain different Ghostscript versions.

Does ImageMagick use Ghostscript?

ImageMagick can use Ghostscript as a delegate for processing PDF and PostScript documents.

On systems using ImageMagick 7, administrators can inspect the available delegates with:

magick -list delegate

The effective ImageMagick security policy can be displayed with:

magick -list policy

These commands help identify available document-processing functionality.

However, the presence of a Ghostscript delegate does not automatically prove that PDF processing is permitted or reachable from a website.

Administrators should also verify the effective security policy and the application’s actual document-processing behaviour.

Can PDF processing be temporarily restricted?

When an immediate Ghostscript security update is unavailable, administrators can consider restricting the processing of untrusted PDF and PostScript documents.

ImageMagick supports security policies that can prevent certain document formats from being read or processed.

For example, a policy can be configured to deny reading PDF, PostScript and related document formats.

Such restrictions can reduce exposure when applications rely on ImageMagick to invoke Ghostscript.

However, these restrictions should not be applied blindly to production hosting environments.

Some applications rely on document conversion for invoices, reports, previews or other business-critical functionality.

Administrators should therefore test any proposed restriction in a controlled environment before applying it to production systems.

Restricting ImageMagick does not automatically protect applications that invoke Ghostscript directly.

Is CVE-2026-39919 actively exploited?

As of October 13, 2026, there is no reliable public confirmation that CVE-2026-39919 is being actively exploited in the wild.

Wordfence has demonstrated successful Remote Code Execution in a controlled test environment.

The researchers developed two working proof-of-concept exploits for a specific Linux build.

They subsequently tested the same exploit files against ten other Linux package environments.

Across 10,240 test executions on those other environments, the exploits did not succeed.

However, the exploits continued to work against the matching test environment.

These findings demonstrate that exploit reliability depends significantly on the exact software build and operating-system environment.

The results do not prove that other environments cannot be exploited with specially adapted payloads.

Vservs therefore distinguishes between technically demonstrated Remote Code Execution and confirmed active exploitation against production systems.

Check Linux servers for possible compromise

Administrators of servers that process externally supplied PDF documents should review available logs and system activity.

Potential warning signs include:

• unexpected Ghostscript process crashes;
• unusual errors during PDF conversion;
• repeated suspicious PDF uploads;
• unexpected processes started by web server or PHP users;
• unusual executable files in temporary directories;
• unexpected modifications to website files;
• suspicious outbound network connections from document-processing processes;
• unexplained failures when generating PDF previews.

These are general investigation indicators rather than confirmed vulnerability-specific Indicators of Compromise.

A Ghostscript crash or failed PDF conversion alone does not prove that an attacker successfully exploited CVE-2026-39919.

Where suspicious activity is identified, administrators should correlate application logs, web server logs and operating-system events.

What should Linux and WordPress administrators do?

Vservs recommends the following actions:

1. Check whether Ghostscript is installed on the server.
2. Determine the installed distribution package version.
3. Consult the official security advisory for the Linux distribution.
4. Install the available security update as soon as possible.
5. Check whether websites accept PDF uploads from untrusted users.
6. Determine whether uploaded PDF documents are automatically converted into images.
7. Review ImageMagick and PHP Imagick configuration where applicable.
8. Consider temporarily restricting untrusted PDF processing when no security update is available.
9. Test compatibility before modifying document-processing functionality on production servers.
10. Review available logs for unusual document-processing activity.
11. Check container images and manually installed Ghostscript versions separately.

When a patched package is not yet available, additional isolation of document-processing services can help reduce the potential impact of exploitation.

Such measures may include restricting process permissions, isolating conversion workloads and limiting access to sensitive application files.

These measures do not replace the official security update.

Managed VPS Hosting at Vservs

The Ghostscript vulnerability demonstrates why website security involves more than updating WordPress Core, plugins and themes.

Operating-system packages, document-processing libraries and other server components also require ongoing security maintenance.

With Vservs Managed VPS Hosting, organisations can outsource the technical management of their Linux server environment.

Depending on the selected service, Vservs provides operating-system maintenance, security updates, server hardening, monitoring and technical support.

Application-specific updates and custom software maintenance are included only where explicitly agreed.

Our focus is on providing professionally managed hosting environments with attention to security, stability and business continuity.

Summary

• Software: Artifex Ghostscript
• CVE: CVE-2026-39919
• Vulnerability: Heap-based buffer overflow
• Affected component: JPEG 2000 processing
• Severity: Critical
• CVSS 3.1: 9.8
• Affected upstream versions: Ghostscript 9.21 through 10.07.1
• First patched upstream version: Ghostscript 10.08.0
• Debian 12: Listed as vulnerable on October 13, 2026
• Debian 13: Security update available
• Ubuntu: Security updates available for supported releases
• Potential impact: Memory corruption and Remote Code Execution
• Unauthenticated exploitation: Demonstrated under specific conditions
• Active exploitation in the wild: Not confirmed
• Recommendation: Apply security updates and review untrusted PDF processing

Sources

• Wordfence – Technical Research into CVE-2026-39919
  

Bricksforge CVE-2026-85097 is a critical WordPress security vulnerability that is actively being exploited by attackers. The flaw allows unauthenticated attackers to upload malicious PHP files to vulnerable WordPress websites and execute arbitrary code on the server.

Security researchers at Patchstack have confirmed exploitation attempts targeting affected Bricksforge installations. The first attacks were observed on October 7, 2026, at 21:47 UTC.

With a CVSS score of 10.0 according to Patchstack, CVE-2026-85097 represents a serious security risk. Website administrators should update Bricksforge immediately and investigate previously exposed installations for signs of compromise.

What is Bricksforge CVE-2026-85097?

Bricksforge is a commercial WordPress plugin that extends the functionality of Bricks Builder, a visual website-building platform for WordPress.

The plugin provides additional features for advanced forms, animations, dynamic content, custom interactions and backend functionality.

CVE-2026-85097 affects the processing of temporary file uploads within the Bricksforge Pro Forms functionality.

The vulnerability is classified as an Unauthenticated Arbitrary File Upload security issue that can lead to Remote Code Execution (RCE).

Successful exploitation allows an attacker to place executable PHP code on the affected server without requiring a valid WordPress account.

How does the Bricksforge vulnerability work?

The security issue originates from insufficient validation of file metadata during form submission.

Bricksforge initially checks the MIME type of an uploaded file. However, when the form is subsequently submitted, the vulnerable implementation trusts certain file metadata supplied by the client.

In particular, the plugin does not adequately validate the destination URL contained in the temporaryFileUploads parameter.

An attacker can abuse this behaviour to cause a previously accepted image file to be stored under a PHP-related filename.

If the resulting file is placed in a web-accessible location where PHP execution is permitted, the attacker can execute the malicious code by requesting that file.

This can result in Remote Code Execution within the permissions of the PHP process handling the affected website.

Which Bricksforge versions are vulnerable?

Patchstack has confirmed the following affected and patched versions:

• Software: Bricksforge for WordPress
• CVE: CVE-2026-85097
• Vulnerability: Unauthenticated Arbitrary File Upload / Remote Code Execution
• Affected versions: Bricksforge 3.1.8.9 and earlier
• First patched 3.x version: 3.1.8.10
• Recommended 4.x security update: 4.0.1 or later
• Severity: Critical
• CVSS: 10.0 according to Patchstack
• Authentication required: No
• Active exploitation: Confirmed

Bricksforge released version 4.0.1 on October 8, 2026, containing a security correction for Pro Forms file uploads.

Administrators using the 4.x branch should install version 4.0.1 or later. Users remaining on the 3.x branch should install at least version 3.1.8.10.

Vservs recommends using the latest stable and supported Bricksforge release compatible with the website.

Active exploitation confirmed by Patchstack

CVE-2026-85097 is not merely a theoretical vulnerability. Patchstack has confirmed that attackers are actively attempting to exploit affected WordPress installations.

The first exploitation attempts were observed on October 7, 2026, at 21:47:17 UTC.

Researchers identified automated attack activity originating from multiple IP addresses.

The attacks target vulnerable Bricksforge form submission functionality and attempt to manipulate temporary file upload metadata.

Patchstack has observed attackers testing different filenames, extensions, encodings and capitalization patterns.

These findings confirm active exploitation attempts in the wild. However, they do not establish that every targeted website was successfully compromised.

Which WordPress endpoints are being targeted?

According to Patchstack, the observed attacks primarily target the following REST API endpoint:

/wp-json/bricksforge/v1/form_submit

Attackers have also targeted WordPress AJAX functionality associated with Bricksforge.

Relevant investigation indicators include:

• requests to the Bricksforge form submission REST API;
• form submissions containing the temporaryFileUploads parameter;
• unexpected combinations of image filenames and PHP-related destination filenames;
• requests involving the bricksforge_regenerate_nonce AJAX action;
• repeated attempts using different file extensions or encoded filenames;
• HTTP requests to newly created PHP files inside upload directories.

These indicators should be investigated in context. A request to the legitimate form endpoint alone does not prove that exploitation succeeded.

What damage can successful exploitation cause?

Remote Code Execution is one of the most serious categories of web application vulnerabilities.

Successful exploitation of CVE-2026-85097 may allow an attacker to execute PHP code within the security context of the affected website.

Potential consequences include:

• uploading and executing malicious PHP files;
• installing web shells and other malware;
• modifying WordPress files and website content;
• accessing sensitive configuration information;
• reading database credentials from application configuration files;
• creating unauthorized WordPress administrator accounts;
• establishing persistent access to the compromised website;
• using the compromised website for additional malicious activities.

The vulnerability does not automatically provide operating-system-level root privileges.

The practical impact depends on the permissions assigned to the PHP process, the server configuration and any additional security controls.

Are websites without file upload fields also at risk?

Bricksforge has warned that websites using Pro Forms should install the security update even when their forms do not contain visible file upload fields.

The vulnerable behaviour involves the internal processing of temporary upload metadata rather than simply the presence of a visible upload field.

Administrators should therefore not assume that removing a file upload field from a form provides sufficient protection.

Updating the affected plugin remains the recommended solution.

How to check WordPress for possible compromise

Because active exploitation attempts have been confirmed, administrators should not limit their response to installing the security update.

Websites that previously ran vulnerable Bricksforge versions should also be investigated for suspicious files and activity.

Pay particular attention to:

• unexpected PHP files in /wp-content/uploads/;
• suspicious files in /wp-content/uploads/bricksforge/tmp/;
• unknown PHP files with names matching login_admin_*.php;
• unexpected executable files in temporary upload directories;
• unusual requests to the Bricksforge REST API;
• requests containing suspicious temporaryFileUploads metadata;
• unknown WordPress administrator accounts;
• unexpected modifications to plugins, themes or WordPress Core files;
• unexplained outbound network connections;
• unexpected background processes or scheduled tasks.

Review historical web server and application logs from October 7, 2026, onwards where available.

Finding a suspicious file or request does not automatically prove successful exploitation. However, unexpected executable PHP files in upload directories should be treated as a serious warning sign.

Update Bricksforge immediately

Vservs recommends the following actions:

1. Check whether Bricksforge is installed on the WordPress website.
2. Verify the currently installed plugin version.
3. Update affected 3.x installations to at least Bricksforge 3.1.8.10.
4. Update installations using the 4.x branch to Bricksforge 4.0.1 or later.
5. Verify that the security update has been installed successfully.
6. Review available web server and security logs for suspicious activity.
7. Inspect upload directories for unexpected PHP files.
8. Check WordPress administrator accounts and recent administrative changes.
9. Review the integrity of WordPress Core, plugins and themes.
10. Verify that a recent, trustworthy backup is available.

Administrators should obtain Bricksforge updates through the official developer’s distribution and update channels.

Temporary mitigation if an immediate update is not possible

Patchstack has deployed a specific RapidMitigate rule designed to block exploitation attempts targeting CVE-2026-85097.

For websites where an immediate update is not possible, an appropriate virtual patch or Web Application Firewall rule may provide temporary protection.

Administrators can also consider temporarily disabling affected Pro Forms functionality where operationally feasible.

However, these measures do not replace the official security update.

Because active exploitation has been confirmed, postponing the update significantly increases the risk of compromise.

What if the website has already been compromised?

If there are indications that CVE-2026-85097 was successfully exploited, simply updating Bricksforge is not sufficient.

Attackers may already have installed web shells, modified website files or established additional access mechanisms.

Vservs recommends treating confirmed exploitation as a serious security incident.

Depending on the findings, appropriate actions include:

1. Restrict access to the affected website to prevent further malicious activity.
2. Preserve relevant web server, PHP and application logs.
3. Identify and remove unauthorized executable files.
4. Inspect WordPress Core, plugins, themes and Must-Use plugins.
5. Review all WordPress administrator accounts and user permissions.
6. Investigate scheduled tasks and other persistence mechanisms.
7. Rotate potentially exposed passwords, API keys and database credentials.
8. Invalidate existing WordPress sessions when privileged access may have been compromised.
9. Restore the website from a verified clean backup if necessary.
10. Monitor the website for renewed suspicious activity after remediation.

When the full extent of the compromise cannot be reliably determined, rebuilding the affected environment from trusted sources may be necessary.

Managed WordPress Hosting at Vservs

The actively exploited Bricksforge vulnerability demonstrates why WordPress security requires continuous attention.

Even professionally developed commercial plugins can contain serious security flaws that require urgent updates.

With Vservs Managed WordPress Hosting, organisations can outsource the technical management and security maintenance of their WordPress websites.

Depending on the selected service, Vservs provides:

• WordPress Core, plugin and theme updates;
• security hardening;
• website and server monitoring;
• malware checks and security investigations;
• regular backups;
• SSL management;
• performance optimisation;
• professional technical support.

For business-critical WordPress websites and WooCommerce stores, Vservs also offers Managed WordPress Pro and Managed WordPress Private with dedicated VPS resources and more extensive technical management.

Our focus is on maintaining secure, stable and professionally managed WordPress environments.

Summary

• Software: Bricksforge for WordPress
• CVE: CVE-2026-85097
• Vulnerability: Unauthenticated Arbitrary File Upload / Remote Code Execution
• Severity: Critical
• CVSS: 10.0 according to Patchstack
• Affected versions: Bricksforge 3.1.8.9 and earlier
• First patched 3.x version: 3.1.8.10
• Recommended 4.x update: 4.0.1 or later
• Authentication required: No
• Active exploitation: Confirmed
• First observed attacks: October 7, 2026, 21:47 UTC
• Potential impact: PHP code execution, malware installation and WordPress compromise
• Recommendation: Update immediately and investigate previously exposed websites for signs of compromise

Sources

• Patchstack – Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
• Patchstack Vulnerability Database – CVE-2026-85097
• Bricksforge – Official Version Changelog
• NIST NVD – CVE-2026-85097

A critical Traveler vulnerability tracked as CVE-2026-93947 allows unauthenticated attackers to perform Blind SQL Injection against affected WordPress websites. The vulnerability affects Traveler theme versions up to and including 3.2.9 and has a CVSS 3.1 score of 9.3 Critical.

Traveler is a commercial WordPress theme widely used for travel websites, hotel reservations, holiday rentals, tours and online booking platforms.

The vulnerability was publicly disclosed in October 2026 and has been fixed in Traveler version 3.3. Vservs recommends installing the latest stable release available from the developer rather than continuing to use an affected version.

What is the Traveler vulnerability CVE-2026-93947?

CVE-2026-93947 is a Blind SQL Injection vulnerability in the Traveler WordPress theme developed by Shinetheme.

The vulnerability occurs because certain externally supplied data is not sufficiently separated from SQL commands before being processed by the database.

Under the affected conditions, an unauthenticated attacker can influence the behaviour of a database query by submitting specially crafted input.

This may allow information stored in the WordPress database to be inferred without requiring an existing WordPress user account.

The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Which Traveler versions are vulnerable?

According to the published security advisory, the following versions are affected:

• Software: Traveler WordPress Theme
• Developer: Shinetheme
• CVE: CVE-2026-93947
• Affected versions: Traveler 3.2.9 and earlier
• First patched version: Traveler 3.3
• Recommended version: Traveler 3.3 or the latest stable release available
• Vulnerability: Blind SQL Injection
• Severity: Critical
• CVSS 3.1: 9.3
• Authentication required: No
• User interaction required: No

Patchstack confirms that version 3.3 contains the security fix for CVE-2026-93947.

Administrators should also check whether any Traveler companion plugins or related booking components require updates.

How does Blind SQL Injection work?

WordPress uses a database to store website content, user information, settings and data belonging to installed plugins and themes.

Booking websites may additionally store reservations, customer information, accommodation details and other business-related data.

SQL Injection occurs when externally controlled input is incorporated into a database query without adequate separation between data and SQL syntax.

An attacker may then be able to influence the query executed by the database.

In a Blind SQL Injection attack, the database does not necessarily return the requested information directly to the attacker.

Instead, information may be inferred by analysing differences in application responses, database errors or processing behaviour.

The exact exploitation method depends on the vulnerable code path and the database configuration.

CVSS 9.3: Critical severity

CVE-2026-93947 has a CVSS 3.1 score of 9.3 Critical.

The published CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

This indicates:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: Low

The CVSS classification highlights the potential confidentiality impact of the vulnerability.

It is important to note that the published vector does not establish arbitrary database modification or direct Remote Code Execution.

What information could be exposed?

The practical impact depends on the database configuration, the available application data and the permissions assigned to the WordPress database account.

Depending on the affected installation, information potentially at risk may include:

• WordPress user information;
• customer and account details;
• booking and reservation information;
• website configuration data;
• information stored by installed WordPress plugins;
• other sensitive data accessible through the affected database queries.

The presence of CVE-2026-93947 does not automatically mean that customer information has been accessed or stolen.

Actual data exposure would need to be established through investigation of the affected website and available logs.

Why is this particularly relevant to booking websites?

Traveler is commonly used for websites that provide travel-related services, hotel bookings, holiday accommodation, tours and reservations.

These websites may process personal information and commercially sensitive booking data.

A vulnerability affecting database confidentiality is therefore particularly relevant to organisations that depend on their booking platform for daily operations.

Even when payment card information is handled by an external payment service provider, the WordPress database may still contain personal information, booking details and other sensitive records.

Organisations should therefore assess the potential impact based on the actual data stored within their Traveler installation.

Is CVE-2026-93947 actively exploited?

As of October 12, 2026, Vservs has found no reliable public confirmation that CVE-2026-93947 is being actively exploited in the wild.

Patchstack has confirmed the vulnerability and published the affected and patched versions.

The vulnerability is considered high priority because it can be reached without authentication and has a potentially serious impact on database confidentiality.

However, the technical possibility of exploitation should not be confused with confirmed attacks against production websites.

Vservs recommends installing the available security update without unnecessary delay.

Check Traveler websites for suspicious activity

Administrators of websites that previously ran Traveler 3.2.9 or earlier should review available application, web server and database logs.

Pay particular attention to:

• unusual requests involving public booking or search functionality;
• repeated requests containing unexpected query parameters;
• unusual SQL errors or database warnings;
• unexpected differences in application response times;
• unexplained increases in database activity;
• repeated requests with unusual encoding or SQL-related syntax;
• unexpected access to sensitive application data;
• unusual activity involving WordPress user accounts.

These checks are general investigation measures rather than confirmed vulnerability-specific indicators of compromise.

The publicly available vulnerability description does not identify a specific endpoint or request parameter that can be used as a universal indicator of exploitation.

An unusual database error or HTTP request alone does not prove that exploitation was successful.

How to update Traveler safely

Vservs recommends the following actions:

1. Check whether the Traveler theme is installed.
2. Verify the currently installed theme version.
3. Create or verify a recent backup of the website and database.
4. Update Traveler to version 3.3 or later.
5. Preferably install the latest stable release available from Shinetheme.
6. Update any associated Traveler plugins and booking components.
7. Verify that the updated theme is active.
8. Test booking forms, availability searches and reservation functionality.
9. Check payment integrations and confirmation emails.
10. Review available logs if the website was previously exposed while running a vulnerable version.

Commercial WordPress themes may require an active license or access to the developer’s update system.

Administrators should obtain the update from the official developer rather than downloading modified theme packages from untrusted sources.

Temporary mitigation if an immediate update is not possible

If the security update cannot be installed immediately, a properly configured Web Application Firewall may provide additional protection against certain SQL Injection attempts.

Administrators should also review publicly accessible booking and search functionality and determine whether unnecessary features can temporarily be restricted.

Database accounts should follow the principle of least privilege wherever technically possible.

These measures can reduce the potential impact of exploitation, but they do not replace the official security update.

What if sensitive information has already been exposed?

If investigation indicates that an attacker successfully exploited the vulnerability, updating Traveler alone may not be sufficient.

Administrators should determine which information may have been accessible and whether unusual database activity occurred.

Depending on the findings, the investigation should include:

• WordPress user accounts and permissions;
• booking and reservation records;
• database access and application logs;
• application configuration files;
• database credentials and API keys;
• integrations with external booking or payment services;
• available backups and their integrity.

Relevant credentials should be rotated when there is reason to believe they may have been exposed.

If personal information may have been accessed, organisations should also assess whether the incident creates obligations under applicable privacy and data protection legislation, including GDPR where relevant.

Managed WordPress Hosting at Vservs

WordPress websites that process bookings, reservations and customer information require careful technical maintenance.

Security updates must be installed promptly while preserving the functionality of the website and its business-critical integrations.

With Vservs Managed WordPress, organisations can outsource the technical management of their WordPress environment.

Depending on the selected service, Vservs provides WordPress Core, plugin and theme updates, security hardening, monitoring, backups, SSL management and performance optimisation.

For business-critical booking websites and WooCommerce stores, Vservs also offers Managed WordPress Pro and Managed WordPress Private with dedicated VPS resources and more extensive technical management.

Our focus is on providing a secure, stable and professionally maintained hosting environment.

Summary

• Software: Traveler WordPress Theme
• Developer: Shinetheme
• CVE: CVE-2026-93947
• Vulnerability: Blind SQL Injection
• CWE: CWE-89
• Severity: Critical
• CVSS 3.1: 9.3
• Affected versions: Traveler 3.2.9 and earlier
• First patched version: Traveler 3.3
• Authentication required: No
• User interaction required: No
• Potential impact: unauthorized inference of database information
• Confirmed arbitrary database writes: No
• Confirmed Remote Code Execution: No
• Active exploitation: not confirmed as of October 12, 2026
• Recommendation: update immediately and investigate suspicious database activity

Sources

• Patchstack – Traveler SQL Injection CVE-2026-93947
• NIST NVD – CVE-2026-93947
• CVE Program – CVE-2026-93947

A critical Avada vulnerability tracked as CVE-2026-97670 allows unauthenticated attackers to trigger unauthorized WordPress actions under specific conditions. The security flaw affects Avada Builder, a core component of the popular Avada WordPress website builder.

The vulnerability has a CVSS 3.1 score of 9.1 Critical. Successful exploitation can cause unauthorized changes to website content, permanent deletion of certain WordPress data and disruption of website functionality.

Avada released version 7.16.2 on September 30, 2026, addressing several security issues, including vulnerabilities involving Avada Forms and notification processing.

What is the Avada vulnerability CVE-2026-97670?

Avada is a commercial WordPress website builder used to create business websites, online stores, landing pages and other WordPress-based applications.

Its functionality includes a theme, the Avada Builder plugin and additional components for creating dynamic content and forms.

CVE-2026-97670 affects the processing of form submissions and dynamic data within Avada Builder.

WordPress uses action hooks to execute functions when particular events occur. These hooks are an important part of the WordPress architecture and are also used by plugins and themes.

Under normal circumstances, sensitive actions should only be triggered when the necessary authorization checks have been performed.

In vulnerable Avada versions, attacker-controlled form data can reach the processing of WordPress action hooks without sufficient authorization validation.

This may allow an external attacker to invoke internal WordPress actions that should not be available through a public form submission.

Which Avada versions are affected?

According to the published vulnerability information, the following versions require attention:

• Product: Avada / Avada Builder (formerly Fusion Builder)
• CVE: CVE-2026-97670
• Affected Avada release levels: up to and including 7.16.1
• Patched Avada release: 7.16.2
• Severity: Critical
• CVSS 3.1: 9.1
• Authentication required: No
• User interaction required: No

Avada released version 7.16.2 on September 30, 2026.

The release includes six security fixes and additional security hardening across several Avada components.

Important: Avada Builder uses a separate plugin version numbering scheme. For example, Avada 7.16.2 is distributed alongside Avada Builder 3.16.2 and Avada Core 5.16.2.

Administrators should therefore verify that the Avada theme and all associated components are updated through the official Avada update system.

How does CVE-2026-97670 work?

The vulnerability originates from insufficient validation of dynamic data submitted through Avada Forms.

Avada Forms supports dynamic placeholders that can be included in notification messages.

Under specific conditions, attacker-controlled form values can be processed through dynamic-data functionality that supports WordPress action hooks.

The vulnerable implementation does not adequately distinguish trusted internal values from data supplied by an unauthenticated visitor.

As a result, an attacker may be able to trigger WordPress actions by submitting specially crafted form data.

The actual impact depends on which WordPress hooks are available and how installed plugins or themes handle those hooks.

What damage can an attacker cause?

Security researchers have demonstrated that CVE-2026-97670 can trigger unauthorized WordPress actions.

One confirmed example involves the WordPress core action responsible for permanently deleting content that has already been moved to the Trash.

By invoking this functionality without authorization, an attacker may permanently delete trashed posts, pages and comments.

Depending on the available WordPress hooks and installed extensions, other consequences may include:

• unauthorized changes to website data;
• permanent deletion of certain WordPress content;
• disruption of website functionality;
• unexpected execution of internal WordPress processes;
• additional unauthorized actions through third-party plugin hooks;
• denial-of-service conditions under certain circumstances.

The vulnerability does not automatically provide full WordPress administrator access or direct operating-system-level Remote Code Execution.

Its practical impact depends on the available action hooks and the configuration of the affected WordPress installation.

When can the Avada vulnerability be exploited?

Not every WordPress website running an affected Avada version is necessarily exploitable through the same attack path.

According to the technical vulnerability description, exploitation requires:

• an affected Avada Builder version;
• a published Avada Form accessible to unauthenticated visitors;
• AJAX-based form submission;
• a notification configuration that processes submitted form fields through dynamic placeholders;
• an email message template containing [all_fields] or an explicit [field] placeholder.

The default configuration of certain Avada Forms may satisfy these requirements.

Websites without the affected form functionality may have a reduced attack surface. However, all administrators running vulnerable Avada versions should install the security update.

Is CVE-2026-97670 actively exploited?

As of October 12, 2026, there is no reliable public confirmation that CVE-2026-97670 is being actively exploited in the wild.

Security researchers have demonstrated the technical impact of the vulnerability, including unauthorized execution of WordPress actions.

However, a technically verified exploit does not automatically mean that attackers are actively exploiting the vulnerability against production websites.

Because the vulnerability is publicly documented and a security update is available, Vservs recommends updating affected installations without unnecessary delay.

Check Avada websites for suspicious activity

Administrators of websites that previously ran a vulnerable Avada version should review available application and server logs for unusual activity.

Pay particular attention to:

• unexpected requests to publicly accessible Avada Forms;
• unusual AJAX form submissions;
• unexpected changes to posts and pages;
• unexplained permanent deletion of content from the WordPress Trash;
• unexpected execution of scheduled WordPress tasks;
• unusual activity recorded in WordPress audit logs;
• unexpected changes to plugin settings;
• unexplained disruptions to WordPress functionality.

Where detailed HTTP request logging is available, administrators can also investigate suspicious form submissions involving dynamic-data placeholders.

These checks are general investigation measures. There is currently no universally reliable indicator of compromise that can conclusively identify every successful exploitation attempt involving CVE-2026-97670.

A suspicious request alone does not prove that an attacker successfully exploited the vulnerability.

How to update Avada safely

Vservs recommends the following actions:

1. Check the installed Avada theme version.
2. Verify that Avada Builder and Avada Core are also up to date.
3. Create or verify a recent backup of the website and database.
4. Update Avada to version 7.16.2 or later.
5. Install the corresponding updated Avada Builder and Avada Core components.
6. Verify that the security update has been installed successfully.
7. Test important website functionality after updating.
8. Check publicly accessible Avada Forms and notification settings.
9. Review available logs if the website was exposed while running a vulnerable version.

Administrators should use the official Avada update mechanism rather than manually combining incompatible theme and plugin versions.

Temporary mitigation if an immediate update is not possible

If updating is temporarily impossible, disabling affected public Avada Forms can reduce the attack surface.

Administrators should review forms that use AJAX submission and dynamic notification placeholders.

A Web Application Firewall may provide additional protection when suitable rules are available.

However, a WAF should not be considered a replacement for installing the official security update.

What if the website has already been compromised?

If there are indications of unauthorized WordPress actions, simply updating Avada may not be sufficient.

Administrators should investigate whether website content, configuration or other application data was modified or deleted.

Depending on the findings, the investigation should include:

• WordPress Core files;
• installed plugins and themes;
• WordPress administrator accounts;
• recent changes to website content;
• scheduled WordPress tasks;
• application and database logs;
• available backups and their integrity.

If content has been permanently deleted, restoration from a verified backup may be necessary.

When there is evidence that credentials or sensitive application data were exposed, the affected credentials should also be rotated.

Managed WordPress Hosting at Vservs

The Avada vulnerability demonstrates why professional WordPress maintenance involves more than simply keeping WordPress Core updated.

Commercial themes, page builders, form plugins and other extensions can introduce serious security risks when vulnerabilities are discovered.

With Vservs Managed WordPress, we provide professional technical management of WordPress websites, including WordPress Core updates, plugin and theme maintenance, security hardening, monitoring, backups and SSL management.

For business-critical websites and WooCommerce stores, Vservs also offers Managed WordPress Pro and Managed WordPress Private, providing dedicated VPS resources and more extensive technical management.

Our focus is on maintaining a secure, stable and professionally managed WordPress environment.

Summary

• Software: Avada / Avada Builder
• CVE: CVE-2026-97670
• Vulnerability: Authorization bypass / arbitrary WordPress action invocation
• Severity: Critical
• CVSS 3.1: 9.1
• Affected Avada release levels: up to and including 7.16.1
• Patched Avada release: 7.16.2
• Authentication required: No
• User interaction required: No
• Attack requirements: specific publicly accessible Avada Forms configuration
• Confirmed technical impact: unauthorized WordPress actions, including permanent deletion of trashed content
• Active exploitation: not confirmed as of October 12, 2026
• Recommendation: update immediately and review previously exposed websites for suspicious activity

Sources

• Wordfence Intelligence – CVE-2026-97670
• Avada – Version 7.16.2 Security Update
• NIST NVD – CVE-2026-97670

A serious LatePoint vulnerability can expose WordPress websites to SQL injection and privilege escalation. Security researchers have identified two separate security issues in the popular appointment booking plugin, tracked as CVE-2026-96662 and CVE-2026-104766.

LatePoint is used by more than 100,000 WordPress websites to manage appointments, reservations, customers and online payments. Both vulnerabilities have been addressed in the available security updates. Vservs recommends updating to LatePoint 5.7.4 or later immediately.

What is the LatePoint vulnerability?

LatePoint is a WordPress appointment booking and scheduling plugin used by businesses and organisations that allow customers to book appointments online.

The plugin is commonly used by healthcare practices, consultants, beauty salons, coaches and other service providers.

LatePoint provides booking forms, customer accounts, appointment management, payment integrations and configurable user permissions.

Two security vulnerabilities have been identified that affect different parts of the plugin:

• CVE-2026-96662: unauthenticated SQL injection, CVSS 7.5 High.
• CVE-2026-104766: authenticated privilege escalation, CVSS 8.8 High.

Although both vulnerabilities affect LatePoint, they have different attack requirements and potential consequences.

CVE-2026-96662: SQL injection without authentication

CVE-2026-96662 is an SQL injection vulnerability that can be exploited without an existing WordPress user account.

The vulnerability affects the processing of the following booking parameter:

booking[service_id]

According to the published vulnerability information, the parameter is insufficiently escaped before being incorporated into an SQL query.

The existing query also lacks sufficient preparation to ensure that attacker-controlled input is handled exclusively as data.

As a result, an unauthenticated attacker may be able to manipulate the resulting SQL query and extract sensitive information from the database.

Which LatePoint versions are affected by CVE-2026-96662?

• CVE: CVE-2026-96662
• Vulnerability: SQL injection
• CWE: CWE-89
• Affected versions: LatePoint 5.7.2 and earlier
• First patched version: LatePoint 5.7.3
• CVSS 3.1: 7.5 High
• Authentication required: No
• User interaction required: No

CVE-2026-104766: privilege escalation through user permissions

The second vulnerability, CVE-2026-104766, affects the handling of certain LatePoint settings and user permissions.

LatePoint supports custom permissions that determine which functions agents and other users can access.

Under specific conditions, a user with the LatePoint permission settings__edit can modify the setting that determines which WordPress role is assigned to newly registered LatePoint customers.

The affected setting is:

default_wp_role_for_customer

By changing this setting to administrator, an attacker with the required LatePoint permissions may cause subsequently registered customer accounts to receive WordPress administrator privileges.

This can potentially result in full administrative control of the affected WordPress website.

What conditions are required for privilege escalation?

Unlike the SQL injection vulnerability, CVE-2026-104766 cannot be exploited by an arbitrary unauthenticated visitor.

The documented attack requires several conditions:

• the website runs a vulnerable LatePoint version;
• the attacker has access to an existing LatePoint account;
• the account has been assigned the settings__edit permission;
• the attacker can modify the default WordPress role for newly registered LatePoint customers;
• a new customer account is subsequently registered through the affected functionality.

The vulnerability therefore depends on an existing account with specific LatePoint permissions.

It does not mean that every anonymous visitor can immediately obtain WordPress administrator access.

Which LatePoint versions are affected by CVE-2026-104766?

• CVE: CVE-2026-104766
• Vulnerability: privilege escalation
• Affected versions: LatePoint 5.7.3 and earlier
• First patched version: LatePoint 5.7.4
• CVSS 3.1: 8.8 High
• Authentication required: Yes, with specific LatePoint permissions
• Potential impact: WordPress administrator privileges

What are the potential consequences?

The two vulnerabilities present different security risks.

Successful exploitation of CVE-2026-96662 may allow an attacker to extract information from the WordPress database.

Depending on the website configuration and database permissions, potentially exposed information may include:

• WordPress user information;
• customer and appointment records;
• booking details;
• website configuration information;
• information stored by other WordPress plugins;
• other data accessible through the affected database queries.

CVE-2026-104766 can have a different impact. Under the documented conditions, an attacker may obtain WordPress administrator privileges through the registration of a new customer account.

Administrator access can potentially allow an attacker to:

• change WordPress settings;
• install or modify plugins;
• create additional administrator accounts;
• modify website content;
• access information available to administrators;
• install malicious code or establish persistent access.

The actual consequences depend on the affected website and the permissions available to the attacker.

More than 100,000 WordPress installations use LatePoint

LatePoint has more than 100,000 active installations according to the WordPress Plugin Directory.

The plugin is particularly relevant to organisations that depend on online appointments and customer scheduling.

These websites may process personal information, appointment histories and other business-related data.

The large installed base does not mean that all installations are exploitable through both vulnerabilities.

The SQL injection issue is reachable without authentication, while the privilege escalation vulnerability requires an existing account with specific permissions.

Are the LatePoint vulnerabilities actively exploited?

As of October 12, 2026, Vservs has found no reliable public confirmation that CVE-2026-96662 or CVE-2026-104766 is being actively exploited in the wild.

Both vulnerabilities have been documented by security researchers, and patched versions are available.

The absence of confirmed active exploitation should not be interpreted as evidence that vulnerable websites are safe.

Vservs recommends installing the available security updates without unnecessary delay.

Check LatePoint websites for possible compromise

Administrators of websites that previously ran vulnerable LatePoint versions should review available application, web server and WordPress audit logs.

Pay particular attention to:

• unknown WordPress administrator accounts;
• new LatePoint customer accounts with unexpected administrator privileges;
• unexpected changes to the default WordPress role assigned to customers;
• users or agents with the settings__edit permission;
• suspicious requests containing unusual booking[service_id] values;
• unexpected SQL errors or database warnings;
• unusual booking or registration activity;
• unexpected changes to plugins, themes or website settings;
• administrator logins from unknown IP addresses.

These checks are general investigation measures rather than confirmed vulnerability-specific indicators of compromise.

An unusual request or unexpected database error alone does not prove that exploitation was successful.

How to update LatePoint safely

Vservs recommends the following actions:

1. Check whether LatePoint is installed on the WordPress website.
2. Verify the currently installed plugin version.
3. Create or verify a recent backup of the website and database.
4. Update LatePoint to version 5.7.4 or later.
5. Verify that the patched version is active.
6. Review which users have access to LatePoint settings.
7. Check the default WordPress role assigned to newly registered customers.
8. Review existing WordPress administrator accounts.
9. Test appointment booking, customer registration and payment functionality after updating.

Administrators should also review installed LatePoint add-ons and ensure that all related components are compatible with the updated plugin.

Temporary mitigation if an immediate update is not possible

If the security update cannot be installed immediately, administrators should reduce access to vulnerable functionality wherever possible.

For CVE-2026-104766, review and restrict the settings__edit permission so that only fully trusted administrators can modify LatePoint settings.

For CVE-2026-96662, a properly configured Web Application Firewall may provide additional protection against certain SQL injection attempts.

Where operationally possible, temporarily restricting affected public booking functionality can further reduce exposure.

These measures are temporary mitigations and should not be considered replacements for installing the official security update.

What if a WordPress website has already been compromised?

If there are indications that either vulnerability has been successfully exploited, updating LatePoint alone may not be sufficient.

Administrators should investigate whether sensitive information was accessed or unauthorized changes were made.

The investigation should include:

• WordPress administrator accounts and user roles;
• LatePoint customer accounts and permissions;
• database and application logs;
• installed plugins and themes;
• WordPress Core files;
• unexpected changes to website configuration;
• API keys, database credentials and other application secrets;
• available backups and their integrity.

When there is evidence that privileged accounts or credentials have been compromised, relevant passwords and other secrets should be rotated from a trusted environment.

If personal information may have been accessed, organisations should also assess whether additional measures are required under applicable privacy and data protection legislation, including GDPR where relevant.

Managed WordPress Hosting at Vservs

WordPress websites that manage appointments, customer information and online payments require careful technical maintenance.

Security updates must be installed promptly while preserving the functionality of booking forms, customer accounts and payment integrations.

With Vservs Managed WordPress Hosting, organisations can outsource the technical management and security maintenance of their WordPress environment.

Depending on the selected service, Vservs provides WordPress Core, plugin and theme updates, security hardening, monitoring, malware checks, backups and SSL management.

For business-critical websites and WooCommerce stores, Vservs also offers managed WordPress environments with dedicated VPS resources and more extensive technical management.

Summary

• Software: LatePoint – Appointment Booking Plugin
• Active installations: more than 100,000
• CVE-2026-96662: unauthenticated SQL injection
• CVSS CVE-2026-96662: 7.5 High
• Affected versions: LatePoint 5.7.2 and earlier
• First patched version: LatePoint 5.7.3
• CVE-2026-104766: authenticated privilege escalation
• CVSS CVE-2026-104766: 8.8 High
• Affected versions: LatePoint 5.7.3 and earlier
• First patched version: LatePoint 5.7.4
• Recommended version: LatePoint 5.7.4 or later
• Active exploitation: not confirmed as of October 12, 2026
• Recommendation: update immediately and review user permissions and suspicious activity

Sources

• Wordfence Intelligence – CVE-2026-96662 SQL Injection
• Patchstack – CVE-2026-104766 Privilege Escalation
• WordPress.org – LatePoint Plugin Directory
• NIST NVD – CVE-2026-96662
• NIST NVD – CVE-2026-104766

A Microsoft Exchange vulnerability tracked as CVE-2026-96940 can allow an authenticated attacker to remotely escalate privileges within an affected Exchange Server environment. The Dutch National Cyber Security Centre (NCSC) has published an alert about the vulnerability and advises organisations running Microsoft Exchange Server on-premises to install the available security update as soon as possible.

CVE-2026-96940 has a CVSS 3.1 score of 8.8 High. Microsoft released the fix on October 2, 2026 as part of the V2 release of its September 2026 Exchange Server Security Updates.

What is the Microsoft Exchange vulnerability CVE-2026-96940?

CVE-2026-96940 is a privilege escalation vulnerability caused by insufficient authorization controls in Microsoft Exchange Server.

An attacker must already possess valid credentials for the Exchange environment. The vulnerability does not therefore provide an unauthenticated attacker with immediate access to an Exchange server.

Once authenticated, however, an attacker can exploit the vulnerable authorization controls remotely over the network to obtain privileges beyond those normally assigned to the compromised account.

This can potentially enable unauthorized administrative actions within the Exchange Server environment.

CVSS 8.8 High

CVE-2026-96940 has a CVSS 3.1 score of 8.8 High.

The vulnerability is particularly relevant because compromised user credentials are a common starting point for attacks against business email environments.

A vulnerability that allows an authenticated attacker to escalate privileges can significantly increase the impact of an account compromise.

Instead of remaining restricted to the permissions associated with the compromised account, successful exploitation can potentially provide access to functions and information for which the attacker was not originally authorized.

Which Microsoft Exchange Server versions require action?

The security updates published by Microsoft cover the following Exchange Server versions:

• Exchange Server Subscription Edition RTM;
• Exchange Server 2019 CU15;
• Exchange Server 2019 CU14;
• Exchange Server 2016 CU23.

Exchange Server 2016 and Exchange Server 2019 are already outside their normal support lifecycle.

Current security updates for these versions are only available to organisations enrolled in Microsoft’s Period 2 Extended Security Update (ESU) programme.

Microsoft recommends that organisations still running Exchange Server 2016 or 2019 migrate to Exchange Server Subscription Edition to continue receiving current security updates.

Exchange Online customers are already protected

Organisations using Exchange Online do not need to install an update to Microsoft’s cloud infrastructure for CVE-2026-96940.

Microsoft has already deployed the necessary protections centrally.

Hybrid environments require additional attention. Even when mailboxes are hosted in Exchange Online, any remaining on-premises Exchange servers must still receive the security update.

Microsoft also recommends updating systems running the Exchange Management Tools.

Microsoft unexpectedly released the update ahead of schedule

CVE-2026-96940 was added to version 2 of the September 2026 Exchange Server Security Updates, published on October 2.

Microsoft describes the release sequence as unusual because the update containing this vulnerability was published ahead of its originally intended schedule.

The company recommends reviewing the deployment guidance and applying the update at the earliest opportunity.

Microsoft states that the vulnerability was identified internally.

Is CVE-2026-96940 actively exploited?

At the time of publication, there is no evidence that CVE-2026-96940 is being actively exploited in the wild.

Microsoft explicitly states that it is not aware of active exploitation.

The Dutch NCSC reaches the same conclusion and reports that there is currently no evidence of exploitation.

NCSC assesses the likelihood of exploitation as medium and the potential impact as high.

Vservs therefore does not classify CVE-2026-96940 as an actively exploited vulnerability. The combination of an available security update, a High severity rating and the potential impact of privilege escalation nevertheless makes prompt patching important.

What can successful privilege escalation mean?

A successful attack can allow an authenticated user to obtain privileges beyond those that should normally be available to the account.

Depending on the affected environment and the privileges obtained, this can potentially lead to:

• unauthorized administrative actions;
• access to sensitive Exchange information;
• changes to Exchange configuration;
• additional access within the mail environment;
• increased impact after the compromise of a legitimate account.

The vulnerability should not be described as an unauthenticated Remote Code Execution vulnerability. A valid account is required before CVE-2026-96940 can be exploited.

What should Exchange administrators do now?

Microsoft and NCSC advise organisations running Exchange Server on-premises to install the available security update as soon as possible.

Vservs recommends:

1. inventory all Exchange servers within the organisation;
2. determine the installed Exchange version and Cumulative Update;
3. install the applicable V2 September 2026 Security Update;
4. update all Exchange servers, including servers retained in hybrid environments;
5. update systems running Exchange Management Tools where applicable;
6. reboot the Exchange server after installation;
7. verify that all Exchange services have started correctly;
8. review authentication and administrative activity for anomalies.

Microsoft recommends using the Exchange Server Health Checker script to identify Exchange servers that are behind on Cumulative Updates, Security Updates or required manual actions.

Exchange 2016 and 2019 require particular attention

Exchange Server 2016 and 2019 have reached the end of their normal support lifecycle.

Only organisations enrolled in Microsoft’s Period 2 ESU programme can obtain the current security updates for these products.

Organisations still operating these versions without the applicable ESU coverage should not assume that their Exchange environment continues to receive normal security maintenance.

Microsoft recommends migration to Exchange Server Subscription Edition.

Check Exchange for suspicious activity

There is currently no confirmed exploitation campaign for CVE-2026-96940 and no vulnerability-specific set of Indicators of Compromise has been published that can conclusively demonstrate exploitation.

Exchange administrators can nevertheless review their environments for general indicators of unauthorized privilege use.

Pay particular attention to:

• unexpected administrative actions;
• unusual authentication activity;
• logins from unexpected IP addresses or locations;
• unexpected permission changes;
• changes to Exchange configuration without a corresponding administrative change request;
• unexpected mailbox access;
• new or modified administrative accounts;
• anomalous activity following the compromise of a legitimate Exchange account.

A suspicious login or configuration change by itself does not prove that CVE-2026-96940 was exploited. Available authentication, Exchange and Windows event logs should be correlated during an investigation.

Business email is a security-critical service

Email remains one of the most security-sensitive services within an organisation. Mailboxes contain business communications, personal data, contracts, invoices, attachments and information that can be highly valuable to attackers.

The security of a professional mail environment therefore depends on more than the mail application itself.

Operating system updates, mail server updates, authentication, TLS configuration, spam and malware protection, backups, monitoring and access management all contribute to the overall security of the environment.

Looking for an alternative to Microsoft Exchange?

Organisations that do not require the complete Microsoft 365 ecosystem do not necessarily have to operate their business email on Microsoft Exchange.

Vservs provides professionally managed Kerio Connect mail servers as an alternative for organisations that want greater control over their business email environment and where their data is hosted.

Our Kerio Connect solutions are particularly suitable for companies and organisations that value professional management, European hosting, data protection and direct technical support.

Kerio Connect mail servers hosted in Europe

With a Vservs Kerio Connect mail server, business email can be hosted on infrastructure within Europe rather than making the organisation dependent on a large public cloud mail platform.

This can support an organisation’s GDPR strategy by providing greater clarity about the hosting location and the technical environment used to process business email.

European hosting alone does not automatically make an organisation GDPR compliant. Compliance also depends on the organisation’s own processing activities, contractual arrangements, technical and organisational measures, retention policies and any processors or subprocessors involved.

Vservs therefore deliberately does not present European hosting as a substitute for a proper GDPR assessment. It is, however, an important consideration for organisations that want greater control over the location and management of their business data.

Professional mail server management by Vservs

Running a secure mail server requires continuous technical management.

With Vservs Kerio Connect, the mail platform is managed as a professional business service rather than leaving customers to maintain an Exchange or generic mail server themselves.

Depending on the selected service and configuration, this includes attention to:

• mail server maintenance and security updates;
• TLS encryption for supported mail protocols;
• spam and malware protection;
• server monitoring;
• mailbox and domain configuration;
• DNS configuration such as SPF, DKIM and DMARC;
• backup and recovery arrangements;
• technical support from Vservs.

Two-factor authentication with Kerio Connect

Kerio Connect supports two-factor authentication for additional protection of user accounts.

It is important to distinguish between interactive Kerio web interfaces and traditional mail protocols.

Two-factor authentication protects interactive access such as Kerio Connect Client/webmail and relevant management access. Traditional mail clients using protocols such as IMAP and SMTP cannot perform an interactive second-factor challenge in the same way.

When 2FA is enabled, application passwords can therefore be used for supported mail clients and applications that connect through these traditional protocols.

This allows organisations to combine two-factor authentication for interactive access with controlled credentials for applications such as desktop and mobile mail clients.

Suitable for organisations handling sensitive information

A professionally managed European mail environment can be particularly relevant to organisations that process confidential or sensitive business information.

Examples include:

• legal and professional services;
• healthcare and care-related organisations;
• consultancies;
• schools and educational organisations;
• SMEs with privacy-sensitive customer information;
• organisations that want more direct control over their business email infrastructure.

The appropriate mail architecture always depends on the organisation’s requirements, risk profile and applicable legal and contractual obligations.

Kerio Connect is not immune to vulnerabilities

Choosing Kerio Connect does not mean that security vulnerabilities can never occur.

Every actively maintained mail platform requires security updates, configuration management and monitoring.

The advantage of a managed Kerio Connect environment at Vservs is therefore not a claim that the software is invulnerable. The value lies in combining a dedicated business mail platform with professional management, European hosting, security controls and direct technical support.

Kerio Connect business email at Vservs

Vservs offers Kerio Connect for organisations that want professional business email without having to manage their own mail server.

Customers can use familiar mail applications through standard protocols while also having access to Kerio’s webmail, calendar, contacts and collaboration functionality.

For organisations considering a move away from Microsoft Exchange or Microsoft 365, Vservs can provide a Kerio Connect environment tailored to the number of mailboxes, storage requirements and technical requirements of the organisation.

Our focus is on a professionally managed mail environment with clear technical responsibility, European hosting and personal support.

Summary

• Software: Microsoft Exchange Server
• CVE: CVE-2026-96940
• Vulnerability: privilege escalation / weak authorization controls
• CVSS: 8.8 – High
• Authentication required: Yes
• Attack vector: Network
• Affected environments: on-premises Exchange Server
• Exchange Online: Microsoft has already deployed protection
• Active exploitation: not confirmed
• NCSC assessment: medium likelihood, high potential impact
• Recommendation: install the V2 September 2026 Exchange Server Security Update as soon as possible

Sources

• National Cyber Security Centre Netherlands – CVE-2026-96940 Exchange Server alert, October 6, 2026
• Microsoft Security Response Center – CVE-2026-96940
• Microsoft Exchange Team – September 2026 V2 Exchange Server Security Updates, October 2, 2026
• Microsoft Support – Exchange Server V2 Security Update documentation

A new Kirki vulnerability can allow Stored Cross-Site Scripting (XSS) under specific conditions without requiring an attacker to already have a WordPress user account. The vulnerability is tracked as CVE-2026-102173 and has a CVSS score of 7.2 High.

According to WordPress.org, Kirki is actively used on more than 500,000 WordPress installations. Kirki versions up to and including 6.3.1 are affected. The security issue has been fixed in version 6.3.2.

What is the Kirki vulnerability CVE-2026-102173?

Kirki is a widely used WordPress plugin and framework for website and theme development. It provides Customizer functionality, visual website development, dynamic content, forms and other components for WordPress websites.

Kirki is also used as a technical framework by WordPress themes. As a result, the component may be present on websites where the administrator does not actively use Kirki as a standalone website-building tool.

CVE-2026-102173 is a Stored Cross-Site Scripting vulnerability involving the processing of certain registration and user data.

According to the published technical information, certain user metadata is not sufficiently sanitized before being processed in an HTML image element.

Which Kirki versions are vulnerable?

• Kirki 6.3.1 and earlier – vulnerable
• Kirki 6.3.2 and later – security fix included

The vulnerability is tracked as CVE-2026-102173 and has a CVSS 3.1 score of 7.2 High.

Vservs recommends updating to the latest stable Kirki version rather than continuing to run an affected release.

How does the Stored XSS vulnerability work?

The vulnerability affects the processing of user metadata within an image element.

Under specific conditions, a user-controlled value can reach the src attribute of an HTML image element without sufficient sanitization.

An attacker may therefore be able to store specially crafted data that causes malicious JavaScript to execute when an affected page is subsequently viewed.

This is known as Stored Cross-Site Scripting because the malicious input is first stored within the WordPress installation and executed later when the affected content is rendered.

This differs from Reflected XSS, where a malicious payload is generally delivered directly to a victim through a specially crafted request or URL.

When can CVE-2026-102173 be exploited?

Not every WordPress website running a vulnerable Kirki version is automatically exploitable through CVE-2026-102173.

The documented attack path requires additional conditions, including:

• the website runs Kirki 6.3.1 or earlier;
• public WordPress user registration is enabled;
• a published page contains a kirki-register element;
• a Kirki user collection displays an image element associated with one of the affected registration fields.

When these conditions are present, an external attacker may be able to submit specially crafted data through the registration process.

An already existing WordPress account is not required for this attack path.

What can Stored XSS allow an attacker to do?

Successful exploitation can cause attacker-controlled JavaScript to execute within the security context of the affected WordPress website.

The practical impact depends on which user views the manipulated content and what functionality is available within that user’s browser session.

Potential consequences can include:

• manipulating content displayed on the website;
• executing unwanted JavaScript actions;
• displaying malicious or misleading content and forms;
• accessing information available within the browser context;
• performing unwanted actions within an existing authenticated session where the necessary conditions are present.

A Stored XSS vulnerability does not automatically provide an attacker with complete access to WordPress or the underlying web server.

The actual impact depends on the context in which the malicious payload executes and the privileges of the affected user.

More than 500,000 active Kirki installations

According to the official WordPress Plugin Directory, Kirki has more than 500,000 active installations.

This makes Kirki a widely deployed WordPress component and theme-development framework.

The large installed base does not mean that all 500,000+ websites meet the configuration requirements necessary to exploit CVE-2026-102173.

However, the combination of a large installed base, a publicly disclosed vulnerability and an available security update makes timely patching important.

Is CVE-2026-102173 actively exploited?

At the time of publication, Vservs has found no reliable public confirmation that CVE-2026-102173 is being actively exploited in the wild.

The publication of technical vulnerability information should not be confused with confirmed active exploitation.

Vservs therefore does not describe this issue as an active attack campaign unless reliable security sources explicitly confirm exploitation in the wild.

Because the vulnerability is publicly known and a patched version is available, affected websites should nevertheless be updated without unnecessary delay.

Update Kirki to version 6.3.2 or later

The security issue has been fixed in Kirki 6.3.2.

WordPress.org confirms several security improvements in the 6.3.2 release, including fixes involving the handling of sensitive metadata.

WordPress administrators can check the installed version through:

WordPress Dashboard → Plugins → Installed Plugins

If Kirki 6.3.1 or earlier is installed, update to at least version 6.3.2 or preferably the latest stable version currently available.

Verify that a current website and database backup is available before updating.

If Kirki functionality is used by the active WordPress theme or other website components, test the Customizer, registration, forms and important frontend functionality after the update.

Check whether public WordPress registration is enabled

Because public user registration is one of the requirements for the documented attack path, administrators should also review this WordPress setting.

The setting can be found under:

WordPress Dashboard → Settings → General

Check whether visitors are currently allowed to register their own WordPress accounts.

If public registration is not required for the website, Vservs recommends disabling it.

Websites that legitimately require registration for membership, community or other functionality do not need to remove that functionality solely because of this vulnerability. The important action is to install a secure Kirki version.

Disabling registration should therefore be considered an additional risk-reduction measure, not a substitute for the security update.

Check the website for possible exploitation

Websites that ran Kirki 6.3.1 or earlier with the affected configuration can also be reviewed for suspicious registration and user data.

Administrators should check for:

• unknown user accounts created during the affected period;
• unexpected HTML or JavaScript content in registration fields;
• suspicious values stored in user metadata;
• unusual registration requests in web server or WAF logs;
• published pages containing a kirki-register element;
• Kirki user collections displaying registration data as images;
• unexpected JavaScript execution on affected pages.

An unusual registration request alone is not evidence that Stored XSS was successfully exploited.

Suspicious requests should be correlated with the data actually stored in WordPress and the behaviour of affected frontend pages.

Check the Kirki version with WP-CLI

Administrators with WP-CLI access can check the installed Kirki version with:

wp plugin get kirki --field=version

Public WordPress user registration can be checked with:

wp option get users_can_register

A value of 1 normally indicates that public user registration is enabled.

These commands can help determine whether a website meets part of the vulnerable configuration, but they do not replace a complete security assessment.

Updating does not remove an already stored XSS payload

With Stored XSS, malicious data that was successfully stored before the security update may remain in the WordPress database after the plugin has been patched.

Updating to Kirki 6.3.2 or later prevents further exploitation through the corrected code path, but it does not automatically remove every suspicious value that may already have been stored.

If there are indications of successful exploitation, review the affected user accounts, user metadata and Kirki content for malicious or unexpected values.

After remediation, verify that affected pages no longer execute unexpected scripts or display manipulated content.

Managed WordPress Hosting at Vservs

The Kirki vulnerability demonstrates why WordPress security does not end with keeping WordPress Core updated. Widely deployed plugins, theme frameworks and website-building components are also an important part of the attack surface.

With Vservs Managed WordPress, we take care of WordPress Core, plugin and theme updates, security hardening, monitoring, malware checks, backups, SSL and technical WordPress management.

For business-critical WordPress websites and WooCommerce stores, Vservs also offers Managed WordPress Pro and Managed WordPress Private with dedicated VPS resources and more extensive technical management.

Summary

• Software: Kirki – Freeform Page Builder, Website Builder & Customizer
• Developer: Themeum
• CVE: CVE-2026-102173
• Vulnerability: Stored Cross-Site Scripting
• CVSS: 7.2 – High
• Active installations: more than 500,000
• Affected versions: Kirki 6.3.1 and earlier
• First patched version: Kirki 6.3.2
• Authentication: no existing account required when the documented conditions are present
• Requirements: including public registration and affected Kirki elements
• Active exploitation: not confirmed at the time of publication
• Recommendation: update immediately and review public user registration

Sources

• Wordfence Intelligence – CVE-2026-102173
• WordPress.org – Kirki Plugin Directory and changelog
• CVE Program – CVE-2026-102173