{"vulnerability": "cve-2026-7800", "sightings": [{"uuid": "b852eac0-f837-4111-9eb0-3e51c01c6b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fzkcx23d26e5l", "content": "CVE-2026-78003 - Mailgun for WordPress\nCVE ID : CVE-2026-78003\n \n Published : Aug. 22, 2026, 9:16 a.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up...", "creation_timestamp": "2026-08-22T10:46:57.352958Z"}, {"uuid": "31692ab5-35ca-4ce8-a461-c6751883624c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78003", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117138340214723722", "content": "CRITICAL: Mailgun for WordPress \u22642.2.0 vulnerable to SSRF (CVE-2026-78003). Attackers can exploit input validation in add_list() to hijack admin resets & compromise sites. Update/disable plugin now. https://radar.offseq.com/threat/cve-2026-78003-cwe-918-server-side-request-forgery-ssrf-in-mailgun-mailgun-for-wordpress-6ee94923f1ee4923 #OffSeq #WordPress #Infosec #SSRF", "creation_timestamp": "2026-08-22T09:00:25.307366Z"}, {"uuid": "158a5b9d-c099-4a59-b4e3-e47fee13f630", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78003", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtnvxy3zpx2c", "content": "Mailgun for WordPress \u22642.2.0 hit by CRITICAL SSRF (CVE-2026-78003). Unauthenticated attackers can hijack admin resets via site API key. Update/disable plugin ASAP. https://radar.offseq.com/threat/cve-2026-78003-cwe-918-server-side-request-forgery-ssrf-in-mailgun-mailgun-for-wordpress-6ee94923f1ee...", "creation_timestamp": "2026-08-22T09:00:26.981179Z"}, {"uuid": "300b885e-03a5-4328-91c2-f3427766279a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtnw5sgefb2m", "content": "\u26a0\ufe0f PATCH NOW\n\nA critical flaw in the Mailgun for WordPress plugin lets a stranger reroute your site's email and reset the admin password. No login needed.\n\nRuns on 80,000+ sites. Affects versions up to 2.2.0.\n\nFix: update to 2.2.1+. (CVE-2026-78003)", "creation_timestamp": "2026-08-22T09:03:42.657911Z"}, {"uuid": "3cbc984a-dd62-404a-8754-0fcc79809fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtnxmy4vyp24", "content": "CVE-2026-78003 - mailgun for wordpress\nThe Mailgun for WordPress plugin (versions up to 2.2.0) lets anyone on the internet send crafted requests that use your site\u2019s Mailgun API key. An attacker could create\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mailgun #CVE #infosec", "creation_timestamp": "2026-08-22T09:30:04.978399Z"}, {"uuid": "dec0a778-3291-4436-ade0-ac5388aeafaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtnxwwqkt42v", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3Mailgun (v2.2.0\u4ee5\u524d) \u3067\u3001\u4e0d\u6b63\u306a\u5165\u529b\u306b\u3088\u308a\u30d1\u30b9\u30fb\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u3092\u4ecb\u3057\u305fSSRF\u8106\u5f31\u6027\u304c\u5b58\u5728\u3002\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u4e57\u3063\u53d6\u308a\u306e\u53ef\u80fd\u6027\u3002\nCVE-2026-78003 CVSS 9.8 | CRITICAL", "creation_timestamp": "2026-08-22T09:35:39.170459Z"}, {"uuid": "fe13a0c0-2d7a-49ab-ab81-84018f447a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtnzcjyhb324", "content": "\ud83d\udd34 CVE-2026-78003 - Critical (9.8)\n\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78003/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T10:00:03.352546Z"}, {"uuid": "7fd2358c-167f-4654-9fce-b4c3c4084a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtnzpgyur52e", "content": "\ud83d\udea8 CVE-2026-78003 \u2014 CVSS 9.8 CRITICAL\n\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78003\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-22T10:07:19.942998Z"}, {"uuid": "a14c35a8-4ffe-42ac-b1c9-635338307191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "seen", "source": "https://t.me/captainsmok3r_official/469", "content": "CVE-2026-78003:\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.\npoc: https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-78003/poc.py", "creation_timestamp": "2026-08-24T18:00:03.543571Z"}, {"uuid": "efd06d90-fc4b-45ae-a50e-8dbba15cc52c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78003", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/469", "content": "CVE-2026-78003:\nThe Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.\npoc: https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-78003/poc.py", "creation_timestamp": "2026-08-25T00:00:11.574024Z"}, {"uuid": "becdb99b-5a0d-4238-82b6-aa0a2f175a36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78002", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mumkx6urax2z", "content": "rsyslog: 8.2606.0 -> 8.2608.0, fix CVE-2026-78002\n\nhttps://github.com/NixOS/nixpkgs/pull/558273\n\n#security", "creation_timestamp": "2026-09-03T13:35:41.437127Z"}, {"uuid": "7b3ed2ce-5d8c-4875-8b10-236ae71df0d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78002", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mumq447ubq24", "content": "[Backport release-26.05] rsyslog: 8.2606.0 -> 8.2608.0, fix CVE-2026-78002\n\nhttps://github.com/NixOS/nixpkgs/pull/559531\n\n#security", "creation_timestamp": "2026-09-03T15:07:55.597864Z"}, {"uuid": "80f95ad5-b40c-44cf-8898-74c3ab68b741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvcmxayqve25", "content": "CVE-2026-78006 - the events calendar\nThe Events Calendar add\u2011on for WordPress (versions up to 6.17.4) can be tricked into running any code an attacker sends, without needing a login. This could let a malicious\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#stellarwp #CVE #infosec", "creation_timestamp": "2026-09-12T08:10:04.956222Z"}, {"uuid": "3475d176-4ba0-4992-b962-e318c880cb80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvcpr2g3nq23", "content": "\ud83d\udd34 CVE-2026-78006 - Critical (9.8)\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78006/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T09:00:18.897050Z"}, {"uuid": "50bb4236-0c9e-4b86-afbe-45d433e19d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvcq3ocjgy2y", "content": "\ud83d\udd34 CVE-2026-78006 - Critical (9.8)\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versio...\n\nhttps://www.themasherwire.com/vulnerability/CVE-2026-78006/\n\n#infosec #potatosecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T09:06:14.312846Z"}, {"uuid": "640fbc09-6ee3-4f14-a77c-0d50b36d819b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/guyvmqtmjocc3", "content": "CVE-2026-78006 - The Events Calendar\nCVE ID : CVE-2026-78006\n \n Published : Sept. 12, 2026, 8:16 a.m. | 43\u00a0minutes ago\n \n Description : The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_s...", "creation_timestamp": "2026-09-12T09:30:02.550412Z"}, {"uuid": "42e9081c-e9e7-4a5e-90bf-28a44b0a27fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78006", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117257602626629740", "content": "CVE-2026-78006: CRITICAL RCE in The Events Calendar plugin (<=6.17.4) for WordPress. Unauthenticated attackers can exploit comments to run code on the server. Disable event comments now & check for patches. https://radar.offseq.com/threat/cve-2026-78006-cwe-502-deserialization-of-untrusted-data-in-stellarwp-the-events-calendar-efa20e86741ba4b3 #OffSeq #WordPress #RCE #Vuln", "creation_timestamp": "2026-09-12T10:30:25.168007Z"}, {"uuid": "3103e173-3f52-4551-b54b-0b7450416c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78006", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvcusam5ho2y", "content": "The Events Calendar plugin (<=6.17.4) has a CRITICAL RCE vuln (CVE-2026-78006). Unauth'd attackers can exploit event comments. Disable comments & check for updates. https://radar.offseq.com/threat/cve-2026-78006-cwe-502-deserialization-of-untrusted-data-in-stellarwp-the-events-calendar-efa20e8674...", "creation_timestamp": "2026-09-12T10:30:27.350854Z"}, {"uuid": "4699735a-cc95-4a6a-b2a2-8f6b9038b73a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvctij4db225", "content": "\ud83d\udea8 CVE-2026-78006 \u2014 CVSS 9.8 CRITICAL\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78006\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-12T10:07:06.463008Z"}, {"uuid": "b84a271c-e568-4e48-a056-4c73968fc059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://gist.github.com/ichintu/835153b1c0908bb605b1d9e1193ac0bc", "content": "This daily cybersecurity briefing highlights four key developments:\n\u2022 **AI in SOCs:** AI-triggered alerts are now the fastest-growing security category, driven by routine enterprise AI adoption rather than targeted attacks.\n\u2022 **New Defense Tool:** The community released the MCP Security Scanner, which identifies and categorizes 12 distinct AI-related risk types.\n\u2022 **AI-Driven Attack:** Coordinated OpenAI agents successfully compromised RubyGems servers, achieving remote code execution.\n\u2022 **Critical Vulnerability:** CVE-2026-78006 (CVSS 9.8) enables unauthenticated RCE in The Events Calendar WordPress plugin (\u22646.17.4) via a comment moderation bypass.\n\nCollectively, these updates underscore AI\u2019s dual impact on cybersecurity\u2014accelerating both defensive tooling and sophisticated attacks\u2014while highlighting urgent patching needs for widely used enterprise software.", "creation_timestamp": "2026-09-12T12:05:16.347349Z"}, {"uuid": "fc8d53a4-7b1c-455f-9cec-8e9e03bf2619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://t.me/GithubRedTeam/102125", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-78006-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeadExpl0it\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 11:42:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T14:00:03.361198Z"}, {"uuid": "fc7bc8d5-4aa4-41e2-806e-0a431cfaa3b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvdvasmhki2z", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-78006: The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\nCVSS 9.8 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-78006\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T20:11:14.748548Z"}, {"uuid": "ee05705c-819f-4b72-982f-b23d5f3ded0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102125", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-78006-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeadExpl0it\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 11:42:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T00:00:41.480183Z"}, {"uuid": "0316c882-6983-4913-a832-7f26c10fd69c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117261495402512030", "content": "CVE-2026-78006: The Events Calendar plugin \u22646.17.4 has a CRITICAL RCE flaw. Unauthenticated attackers can run code via comment handling \u2014 disable event comments until patched. Review vendor advisories. https://radar.offseq.com/threat/the-the-events-calendar-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-versions-up-6446d1c8dfcb6a24 #OffSeq #WordPress #CVE202678006 #RCE", "creation_timestamp": "2026-09-13T03:00:24.185201Z"}, {"uuid": "856923a6-3441-45dc-94cd-a4c08390e7b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvem4iazbe2y", "content": "The Events Calendar plugin for WordPress \u22646.17.4 has a CRITICAL RCE (CVE-2026-78006). Unauthenticated code execution possible \u2014 disable event comments & watch for patches. https://radar.offseq.com/threat/the-the-events-calendar-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-ve...", "creation_timestamp": "2026-09-13T03:00:27.285242Z"}, {"uuid": "9c23f295-3c52-49d8-93dc-65fdb4350cae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvenhx7rqc27", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-78006: The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\nCVSS 9.8 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-78006\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T03:24:44.530329Z"}, {"uuid": "a532d1a8-6284-4956-95e8-5d65434bedf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mveygyxx7a2p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-78006: The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\nCVSS 9.8 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-78006\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T06:41:03.876484Z"}, {"uuid": "f3796f34-aa0a-4043-b898-54da12d6e1db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvfcyntdgf2i", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-78006: The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\nCVSS 9.8 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-78006\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T09:49:53.581097Z"}, {"uuid": "cd003c62-162b-4192-be3f-dda6089bba96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvfjxweuny2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-78006: The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\nCVSS 9.8 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-78006\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T11:54:46.109938Z"}, {"uuid": "4dcc8e79-0cdd-4aa4-97fa-dcde32f8b8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "content": "", "creation_timestamp": "2026-09-14T03:00:08.963945Z"}, {"uuid": "5f3c016c-8f9e-4e2e-a24e-7caa82f766cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "Telegram/iBj7RYtihqm6hIuCBk6vB4PmaU6fP95etshgJ7uPz9bghck", "content": "", "creation_timestamp": "2026-09-14T03:00:09.272815Z"}, {"uuid": "8cf3f0c7-6f21-473a-90c8-eee6362b5f55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "Telegram/NaqXpJzudf_kPemcfRLNgSuhJAIsHS0qYFopzKAZDt10jI8", "content": "", "creation_timestamp": "2026-09-14T03:00:11.412278Z"}, {"uuid": "a8a7a35e-744a-4fbc-9afa-63c9ca1389d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvi3j7a6ov24", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-78006: The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution\nCVSS 9.8 \u00b7 EPSS 0.8%\nhttps://beta.vulnsea.com/cve/CVE-2026-78006\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T12:13:58.018303Z"}, {"uuid": "b1c0a720-807c-499f-b54b-dced8cc4bba6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "published-proof-of-concept", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "content": "", "creation_timestamp": "2026-09-15T00:00:25.258040Z"}, {"uuid": "123907e9-1832-4d48-bcaf-96d4e2707e50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "published-proof-of-concept", "source": "Telegram/NaqXpJzudf_kPemcfRLNgSuhJAIsHS0qYFopzKAZDt10jI8", "content": "", "creation_timestamp": "2026-09-15T00:00:23.876593Z"}, {"uuid": "ba3a14fb-ee03-41ca-8afd-c3daae5e7ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "published-proof-of-concept", "source": "Telegram/iBj7RYtihqm6hIuCBk6vB4PmaU6fP95etshgJ7uPz9bghck", "content": "", "creation_timestamp": "2026-09-15T00:00:24.690976Z"}, {"uuid": "e266438c-0526-4544-ba78-f5efa45021c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mvjoy67zf22z", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-78006) The Events Calendar Remote Code Execution via #PHP Object Injection\" and \"Introducing the CyCognito MCP Server: Full Exposure Context, On Demand\".\n \n#cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X", "creation_timestamp": "2026-09-15T03:35:01.151640Z"}, {"uuid": "c52867c7-16cc-4e49-a45c-24a3f091ed66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmf45ohj23", "content": "The Events Calendar CVE-2026-78006 and CVE-2026-78159 (critical unauth RCE) allow anonymous commenters to trigger code execution \u2014 update the plugin or disable comments now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:26:32.968285Z"}, {"uuid": "5bf32d23-30e5-4aca-866f-585a9e8f3ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117280605916782332", "content": "CRITICAL: The Events Calendar WP plugin (<6.17.4.1) has two unauthenticated RCEs \u2014 CVE-2026-78159 (code injection) & CVE-2026-78006 (object injection, comments enabled). 240K+ sites at risk. Update now: https://radar.offseq.com/threat/unauthenticated-rce-flaws-could-expose-200000-wordpress-sites-to-takeover-7f3911d49bdf2638 #OffSeq #WordPress #RCE #Vuln", "creation_timestamp": "2026-09-16T12:00:27.694404Z"}, {"uuid": "da621861-e3ec-48b4-b94f-aa81dd9b63f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78006", "type": "exploited", "source": "https://t.me/true_secator/8618", "content": "\u0411\u043e\u043b\u0435\u0435 200 000 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432 WordPress \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0430\u0442\u0430\u043a\u0430\u043c, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u043c \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0438\u0445 \u0437\u0430\u0445\u0432\u0430\u0442\u0443, \u0432 \u0432\u0438\u0434\u0443 \u0434\u0432\u0443\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 The Events Calendar.\n\n\u041f\u043b\u0430\u0433\u0438\u043d Events Calendar, \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u0438 \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u0431\u043e\u043b\u0435\u0435 600 000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043b\u0435\u0433\u043a\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u0430\u043b\u0435\u043d\u0434\u0430\u0440\u0435\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u0430\u0445.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 Defiant, \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0434\u043e 6.17.3.1 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0434\u0432\u0443\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 (RCE), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0441\u0430\u0439\u0442\u044b.\n\n\u041f\u0435\u0440\u0432\u0430\u044f CVE-2026-78159 (CVSS 9,8) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u044b\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438.\n\n\u041f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0432\u0438\u0434\u0435 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043c\u0430\u0441\u0441\u0438\u0432\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 HTML, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432.\n\nStellarWP, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u043b\u0430\u0433\u0438\u043d\u0430 The Events Calendar, \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0435\u0435 25 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 6.17.3.1 \u043f\u043b\u0430\u0433\u0438\u043d\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-78006 (CVSS 9,8), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 PHP-\u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430, \u0435\u0441\u043b\u0438 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u043a \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u0432\u0438\u0434\u043d\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u043e\u0439\u0434\u0435\u043d\u044b \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0442\u043e\u0440\u043e\u043c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u043e\u0434\u043e\u0431\u0440\u0435\u043d\u0438\u044f, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0434\u043e \u043d\u0430\u0447\u0430\u043b\u0430 \u043c\u043e\u0434\u0435\u0440\u0430\u0446\u0438\u0438.\n\nStellarWP \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432\u0442\u043e\u0440\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 6.17.4.1 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f The Events Calendar, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0433\u043e 10 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f.\n\n\u041a\u0430\u043a \u0437\u0430\u044f\u0432\u043b\u044f\u0435\u0442 Defiant, \u044d\u0442\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043e\u0431\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u043b\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u0414\u0430\u043d\u043d\u044b\u0435 WordPress \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442, \u0447\u0442\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 240 000 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 The Events Calendar \u0432\u0435\u0440\u0441\u0438\u0439 \u043d\u0438\u0436\u0435 6.17, \u0430 \u044d\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0438\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c.\n\n\u0412 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 10 \u043f\u043e 14 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043f\u043b\u0430\u0433\u0438\u043d \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u0435\u0435 300 000 \u0440\u0430\u0437, \u0447\u0442\u043e \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0435\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0432\u0441\u0435 \u0435\u0449\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e CVE-2026-78006.\n\n\u041d\u0435\u044f\u0441\u043d\u043e, \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0430 WordPress \u0443\u044f\u0437\u0432\u0438\u043c\u043e, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u0435\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435. \u041d\u043e \u0432\u0441\u0435 \u0436\u0435.\n\n\u0415\u0441\u043b\u0438 \u0441 The Events Calendar \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043c\u0443\u0434\u0430\u043a\u043e\u0432, \u0442\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2026-27540 \u0432 \u043f\u0440\u0435\u043c\u0438\u0443\u043c-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 WooCommerce Wholesale Lead Capture \u0434\u043b\u044f WordPress \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u043e.\n\nDefiant \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 100 000 \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e CVE-2026-27540. \u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u0435\u0442 Wordfence, \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0440\u0435\u0437\u043a\u043e \u0432\u043e\u0437\u0440\u043e\u0441\u043b\u0430 \u0432 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 4 \u043f\u043e 17 \u0438\u044e\u043d\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441 1 \u0438\u044e\u043b\u044f \u043f\u043e 30 \u0430\u0432\u0433\u0443\u0441\u0442\u0430.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443, \u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u041f\u041e.\n\nCVE-2026-27540 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 2.0.3.1 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.0.3.2 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 WooCommerce Wholesale Lead Capture, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 20 \u0444\u0435\u0432\u0440\u0430\u043b\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 PHP-\u0444\u0430\u0439\u043b\u043e\u0432, \u0438\u0437\u0443\u0447\u0430\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a /wp-admin/admin-ajax.php, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0445 wwlc_file_upload_handler, \u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 Wordfence \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a IP \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 2.0.3.2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439.", "creation_timestamp": "2026-09-18T10:00:06.563575Z"}]}