A critical vulnerability (CVE-2026-15748, CVSS 9.8) in the popular Forminator Forms WordPress plugin allows unauthenticated attackers to upload arbitrary files, including executable PHP webshells, potentially leading to full site takeover.
The flaw affects versions ≤1.56.1 and stems from insufficient file-type validation in the handle_file_upload function. Attackers can forge a Select field value that injects a custom upload configuration, bypassing the dangerous-extension blocklist via MIME-type tricks (e.g., pipe-alternative patterns). Exploitation is practical only on forms that include both a File Upload field and a Select field; custom upload directories without proper .htaccess protections make remote code execution more reliable.
Wordfence disclosed details publicly on August 17 after coordinated reporting. The vendor patched it in version 1.56.2 (released late July). With more than 600,000 active installations, unpatched sites remain high-value targets for mass exploitation, credential theft, and malware deployment. Immediate update to 1.56.2 or later is essential; also audit forms for the risky field combination and review upload directories.
GitLab released urgent out-of-band patches for CVE-2026-19478 (CVSS 9.4), a critical GraphQL directive vulnerability that enables unauthenticated remote attackers to modify or delete public projects and user data under certain conditions.
Affected are GitLab CE/EE versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. The issue involves improper handling of GraphQL directives that can be abused via crafted requests without credentials or user interaction. A second related high-severity GraphQL issue (CVE-2026-19650) was also addressed. GitLab.com and Dedicated instances are already patched; self-managed administrators must upgrade immediately.
No confirmed in-the-wild exploitation was reported at disclosure, but the severity and unauthenticated nature make rapid patching non-negotiable for any publicly exposed GitLab instance. Monitor GraphQL endpoint logs for anomalous activity in the interim.
SafePal confirmed an authorization flaw in an order-tracking plug-in that exposed personal and order information belonging to approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026.
Leaked data includes names, email addresses, shipping addresses, phone numbers, and purchase details. Critically, seed phrases, private keys, wallet passwords, payment card data, and government IDs were not compromised, and there is no evidence of direct wallet or fund access. The company has patched the issue, reduced data retention to 90 days, notified affected users, and taken down dozens of related phishing sites. Stolen records have already appeared for sale on cybercrime forums, heightening phishing and social-engineering risks (especially physical targeting given shipping addresses).
Affected customers should treat unsolicited “support” outreach with extreme caution and enable any available account monitoring. This incident underscores supply-chain and e-commerce risks even for security-focused hardware wallet vendors.
CISA added CVE-2025-62593 (critical code-injection / RCE in the open-source Ray AI/distributed computing framework) to its Known Exploited Vulnerabilities catalog on August 17, citing evidence of active exploitation.
The flaw (patched in Ray 2.52.0) allows remote code execution via a DNS-rebinding attack against developers running local Ray instances when they visit a malicious site (or are hit by malvertising) in browsers such as Firefox or Safari. The original defense relied on a weak User-Agent check that can be bypassed. Federal agencies face a short remediation window; all organizations running Ray should upgrade immediately and restrict browser access on developer workstations that host Ray services.
This highlights ongoing risks in AI/ML tooling where local development servers become attack surface.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.