WordPress Security Roundup: Analyzing Critical RCE, File Upload, and Path Traversal Flaws

Overview of Automated Exploitation in WordPress Ecosystems

Unpatched security vulnerabilities remain the primary vector for automated website compromise. Automated botnets continuously scan WordPress installations for publicly disclosed security flaws, attempting payload delivery across thousands of sites simultaneously. When a vulnerability is disclosed without an immediate patch application on target environments, the window between disclosure and exploitation shrinks rapidly. Securing a WordPress installation requires understanding the specific threat vectors introduced by third-party plugins and enforcing strict patch management procedures alongside compensating controls like Web Application Firewalls (WAFs).

Critical Unauthenticated Remote Code Execution and Object Injection

Remote Code Execution (RCE) and PHP Object Injection represent the highest severity risk class in web application security, enabling unauthenticated attackers to execute arbitrary commands, establish web shells, or fully compromise underlying web servers.

• Kirki Framework (CVE-2026-16747 & CVE-2026-12720): Installed on over 500,000 sites, Kirki contained a critical unauthenticated RCE vulnerability (CVE-2026-16747) affecting versions prior to 6.2.1, resolved in version 6.2.1. Additionally, an unauthenticated PHP Object Injection vulnerability (CVE-2026-12720) affected versions prior to 6.0.13 (patched in 6.0.13). Note that Kirki also suffers from an unauthenticated stored XSS (CVE-2026-66629) affecting versions up to 6.2.4 with no patched version listed, requiring administrator intervention via compensating firewall rules or plugin reassessment.
• Broken Link Checker (CVE-2026-18937): Affecting 500,000+ active installations, version sequences under 2.4.12 suffered from a critical unauthenticated RCE flaw. Systems must be updated to version 2.4.12 or greater to mitigate arbitrary code execution risks.
• All-in-One WP Migration and Backup (CVE-2026-19949): Installed on more than 5,000,000 sites, versions up to 7.109 allowed unauthenticated second-order SQL injection during archive restoration that could lead to Remote Code Execution. Updating to version 7.110 resolves this second-order attack chain.
• Forminator Forms (CVE-2026-66583): Active on over 600,000 sites, Forminator versions up to 1.57.0 were vulnerable to unauthenticated PHP Object Injection, fixed in version 1.57.1.

Arbitrary File Uploads and Unauthenticated Account Takeovers

Vulnerabilities permitting arbitrary file upload or sensitive authentication data exposure give unauthenticated actors direct access to elevate privileges or execute malicious scripts within server directories.

Forminator Forms Arbitrary File Upload (CVE-2026-15748): Forminator Forms (600,000+ installations) contained a critical unauthenticated arbitrary file upload flaw in versions up to 1.56.1, executed via a forged upload field configuration. Administrators must upgrade to version 1.56.2 or higher to prevent unauthorized file writes to the upload directory.

TranslatePress Account Takeover (CVE-2026-19632): Active on over 400,000 sites, TranslatePress versions up to 3.3.1 suffered from an unauthenticated account takeover flaw caused by password reset link disclosure. Attackers capable of intercepting or retrieving disclosed reset tokens could reset administrative credentials. Upgrading to version 3.3.2 eliminates this exposure.

Path Traversal and File Access Vulnerabilities

Path traversal vulnerabilities occur when input validation fails to sanitize directory navigation sequences (such as ../), allowing unauthorized users to escape intended directory roots and access sensitive system files or configuration data.

• W3 Total Cache Path Traversal (CVE-2026-18051): Active on over 900,000 installations, W3 Total Cache versions prior to 2.10.5 allowed unauthenticated attackers to perform path traversal. Sites must update to version 2.10.5 or higher.
• WPvivid Path Traversal (CVE-2026-19725): Over 900,000 installations utilizing WPvivid versions under 0.9.131 were vulnerable to unauthenticated path traversal, patched in release 0.9.131.
• Kirki Path Traversal to Arbitrary File Read (CVE-2026-17604): Authenticated users with Editor privileges in Kirki versions up to 6.1.1 could execute path traversal to read arbitrary system files via the data parameter. Updating to 6.2.0 mitigates the issue.

Vulnerabilities in Cache Optimization and Performance Plugins

Performance plugins process incoming HTTP headers, user comments, and dynamic asset tags, making them frequent targets for Cross-Site Scripting (XSS) and header injection vectors.

• LiteSpeed Cache (CVE-2026-18978 & CVE-2026-3129): Deployed on over 7,000,000 sites, LiteSpeed Cache version 7.8.1 and earlier suffered from high-risk unauthenticated stored XSS via comment content (CVE-2026-18978, patched in 7.9). An additional medium-risk authenticated (Author+) stored XSS existed in version 7.7 via img tag attributes (CVE-2026-3129, patched in 7.8).
• WP Fastest Cache (CVE-2026-19760): Installed on 1,000,000+ sites, versions up to 1.5.0 were vulnerable to unauthenticated stored XSS injected via the HTTP Host header. This vulnerability was addressed in version 1.5.1.
• EWWW Image Optimizer (CVE-2026-15446) & Speed Optimizer (CVE-2026-15421): Both plugins (1,000,000+ active installs each) allowed authenticated Contributor+ users to execute stored XSS—EWWW via the data-script lazy load attribute in post content (patched in 8.7.4) and Speed Optimizer via image tag attributes (patched in 7.8.1).

Form Builder Vulnerabilities and IDOR Risks

Form builders handle critical input parsing, user notifications, draft storage, and file attachments. Flaws in these engines expose applications to stored XSS, Insecure Direct Object References (IDOR), and Server-Side Request Forgery (SSRF).

Forminator Forms Input Exploits: Beyond file uploads, Forminator Forms suffered from multiple unauthenticated flaws across 600,000 installations, including DOM-based XSS via the error_description parameter (CVE-2026-18328, patched in 1.57.0.1), stored XSS in rich-text textareas (CVE-2026-18324, patched in 1.57.0.2), stored XSS in draft radio fields (CVE-2026-18323, patched in 1.57.0.3), and IDOR sensitive information disclosure via the draft parameter (CVE-2026-12998, patched in 1.55.1).

Fluent Forms IDOR & XSS: Fluent Forms (700,000+ installs) contained unauthenticated stored XSS via notification smartcode values (CVE-2026-18146, patched in 6.2.12). It also suffered from IDOR flaws permitting Subscriber+ users to cancel subscriptions (CVE-2026-11880, patched in 6.2.1) and Form Manager+ users to delete cross-form submissions (CVE-2026-11578, patched in 6.2.5).

Royal Addons for Elementor SSRF: Operating on 600,000+ sites, Royal Addons for Elementor versions up to 1.7.1064 contained an authenticated (Contributor+) SSRF flaw in the Form Builder Widget webhook_url setting (CVE-2026-17123, patched in 1.7.1065).

Mitigation Strategies and WAF Deployment

Addressing ecosystem-wide security risks requires multi-layered defensive strategies:

1. Immediate Plugin Updates: Upgrade all highlighted software to or beyond the designated patch release versions immediately.
2. Compensating Controls for Unpatched Software: For plugins lacking an active patch (such as Kirki version ≤ 6.2.4 affected by CVE-2026-66629), audit whether the plugin is required or implement custom firewall rules to block unauthenticated payload submissions.
3. Web Application Firewall (WAF): Deploy a managed WAF (such as the Sucuri Firewall) to inspect incoming HTTP requests, filter malicious headers, block directory traversal patterns, and drop unauthorized API calls before they reach the application layer.
4. Least Privilege Enforcement: Restrict user role capabilities. Ensure lower-tier roles (Subscriber, Contributor, Author) cannot access sensitive REST endpoints or execute unverified shortcodes.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.