Threat Log

Nothing in the entire threat log matches that search. Try a shorter term, for example just the product name or the CVE number.

1. Act now Wordfence

   Easy Post Submission

   CVE-2026-4431

   Affects you if you run the Easy Post Submission plugin in a version up to and including 2.3.0.

   An AJAX endpoint reachable for unauthenticated visitors does not check whether the caller is authorized. An attacker can use it to modify the title, content, excerpt, categories, and tags of arbitrary posts and set the status to draft. The post is then no longer publicly visible.

   Update to version 2.4.0.

   Affected

   Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress

   Fixed in

   2.4.0

   CVSS

   9.1
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.33 %
   percentile 26.1

   Type

   CWE-862

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

2. This week Wordfence

   Page and Post Restriction

   CVE-2026-12000

   Affects you if you use the Page and Post Restriction plugin to hide pages or posts from logged-out visitors.

   The plugin is meant to hide pages and posts from logged-out visitors. The WordPress REST API bypasses that protection. The plugin's internal guards only read a subset of the configuration and miss the global access settings. A stranger can fetch restricted content through the standard REST endpoints without an account.

   The flaw defeats the only purpose of the plugin. Anyone using it to protect content currently has no protection.

   Update the plugin to the latest version and verify that the restricted content is no longer reachable through the REST API.

   Affected

   Page and Post Restriction

   Fixed in

   1.4.2

   CVSS

   7.5
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.66 %
   percentile 48.3

   Type

   CWE-862

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

3. This week Wordfence

   ShopLentor

   CVE-2026-6020

   Affects you if you run ShopLentor up to and including version 3.3.7 and an attacker has obtained administrator access.

   An administrator can call any PHP function through the REST API. The check that limits which functions are allowed is missing. With those privileges the attacker is already deep inside the system, but this hole makes the final step to full compromise particularly easy.

   Update to version 3.3.8.

   Affected

   ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

   Fixed in

   3.3.8

   CVSS

   7.2
   source security@wordfence.com

   Login required

   yes, administrator

   Likely to be exploited

   0.54 %
   percentile 42.5

   Type

   CWE-470

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

4. This week Wordfence

   Askeet — Talk to Your WooCommerce Data

   CVE-2026-5651

   Affects you if you use the Askeet plugin in a version up to and including 3.0 and an attacker has an administrator account.

   A SQL injection via the 'sql_query' parameter in multiple AJAX actions. The askeet_is_safe_query() filter is meant to catch dangerous keywords, but it can be bypassed using MySQL conditional comments. The filter strips regular block comments before checking, but MySQL executes conditional comments as code. An attacker with administrator privileges can append their own queries to existing ones and read from the database.

   The vulnerability requires an administrator account. That severely limits the pool of attackers, which is why the rating stays low. Someone with an administrator account can already do significant damage. The additional database path does not make it harmless, though.

   Update to version 3.1.

   Affected

   Askeet — Talk to Your WooCommerce Data

   Fixed in

   3.1

   CVSS

   4.9
   source security@wordfence.com

   Login required

   yes, administrator

   Likely to be exploited

   0.38 %
   percentile 30.6

   Type

   CWE-89

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

5. This week Wordfence

   DTX – Dynamic Text Extension for Contact Form 7

   CVE-2026-5116

   Affects you if you run DTX – Dynamic Text Extension for Contact Form 7 in version 5.0.5 or older and have users with Editor-level access or higher.

   Stored cross-site scripting in the admin interface. An attacker with an Editor account can place scripts inside form shortcodes that execute when an administrator runs the form field scan feature. The damage depends on what the script does, but the attacker acts in the administrator's context.

   The vulnerability requires an account, which is why it is not marked urgent. If you have editors you do not control yourself, you should still act.

   Update to the version that corrects the output escaping. The source does not name the fixed version, so check the update in the WordPress plugin directory.

   Affected

   DTX – Dynamic Text Extension for Contact Form 7

   Fixed in

   5.0.6

   CVSS

   4.4
   source security@wordfence.com

   Login required

   yes, administrator

   Likely to be exploited

   0.30 %
   percentile 22.1

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

6. This week Wordfence

   PrettyLinks

   CVE-2026-5062

   Affects you if you run PrettyLinks up to and including 3.6.20 and an attacker has gained administrator access.

   An SQL injection in the search function of the Pretty Links listing page. An attacker with administrator privileges can use it to read the database. The vulnerability requires a login with the highest rights, which limits the damage but does not rule it out. Someone who is already an administrator can use this path to access data the WordPress backend does not normally show.

   Update to 3.6.21.

   Affected

   PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links

   Fixed in

   3.6.21

   CVSS

   4.9
   source security@wordfence.com

   Login required

   yes, administrator

   Likely to be exploited

   0.27 %
   percentile 18.7

   Type

   CWE-89

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

7. This week Wordfence

   Super Progressive Web Apps

   CVE-2026-5108

   Affects you if you run the Super Progressive Web Apps plugin in a version up to and including 2.2.43 and an attacker has gained administrator access.

   An administrator can place scripts in the offline message setting that later execute in the browsers of other visitors. The entry is stored without sanitization and passed to the front end without escaping. That is stored cross-site scripting.

   The vulnerability requires administrator privileges. Someone who has those can already do almost anything. It becomes dangerous when an attacker takes over an administrator account and uses it to permanently embed malicious code in the site, code that fires every time the offline message is triggered.

   Update to version 2.2.44.

   Affected

   Super Progressive Web Apps

   Fixed in

   2.2.44

   CVSS

   4.4
   source security@wordfence.com

   Login required

   yes, administrator

   Likely to be exploited

   0.24 %
   percentile 15.9

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

8. For the record Wordfence

   Backup Migration

   CVE-2026-7693

   Affects you if you have the Backup Migration plugin in a version up to and including 2.1.5.1 on your WordPress installation and an attacker has obtained an administrator account or the do_backups capability.

   An OS command injection via the file parameter in the restoreBackup AJAX handler. The handler sanitizes the input with esc_attr, an HTML-context function that does not strip shell metacharacters. The result is then placed, unquoted, into a php-cli call and passed to exec().

   An attacker with administrator rights or the do_backups capability can execute arbitrary OS commands as the web server user. The vulnerability bypasses the usual WordPress hardening constants.

   Update the plugin to a version that closes the vulnerability. The source does not name the fixed version, so please check directly with the vendor or in the WordPress plugin directory whether a version newer than 2.1.5.1 is available.

   Affected

   Backup Migration

   Fixed in

   2.1.5.2

   CVSS

   7.2
   source security@wordfence.com

   Login required

   yes, administrator

   Likely to be exploited

   2.23 %
   percentile 81.1

   Type

   CWE-77

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

9. For the record Wordfence

   TranslatePress

   CVE-2026-17505

   Affects you if you run TranslatePress up to version 3.2.5 and someone clicks a link crafted by a stranger.

   A reflected cross-site scripting. When translating a page, TranslatePress replaces internal placeholder tokens with angle brackets, including in the search query a visitor sends to the page. By that point, WordPress has already sanitized the query, but not the tokens. An attacker can craft a link that, when opened, runs their own script in the page.

   The vulnerability is rated medium at CVSS 6.1 and is not on the KEV list. On its own, it is no reason to interrupt operations, but it belongs in the next maintenance window.

   Update to version 3.2.6. The source does not name a workaround.

   Affected

   TranslatePress – Translate Multilingual sites with AI Translation

   Fixed in

   3.2.6

   CVSS

   6.1
   source security@wordfence.com

   Login required

   no

   Likely to be exploited

   0.80 %
   percentile 53.4

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-08-04

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

10. For the record Wordfence

    Content Egg

    CVE-2026-15979

    Affects you if you run the Content Egg plugin in a version up to and including 11.3.0 and users with the Author role or higher are allowed to write on your installation.

    The plugin stores a filename from user input without sufficient validation. An authenticated user with Author privileges can set this value so that a path traversal sequence is evaluated when the file is later deleted, leading out of the intended directory. This allows arbitrary files on the server that the web server can write to to be deleted.

    The vulnerability requires authentication and is not on the KEV list. The likelihood of widespread exploitation is low, but the damage in individual cases can be significant if configuration files or other plugins are affected.

    Update Content Egg to version 11.4.0.

    Affected

    Content Egg – Affiliate Product Importer & Price Comparison

    Fixed in

    11.4.0

    CVSS

    8.1
    source security@wordfence.com

    Login required

    yes, user account

    Likely to be exploited

    0.77 %
    percentile 52.4

    Type

    CWE-22

    Actively exploited

    not on the KEV list

    Published

    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.