Do Son CVE-2026-8713 is a critical Avada Builder vulnerability enabling unauthenticated arbitrary file deletion on 1M WordPress sites. Update to 3.15.4 now.
Arbitrary File Deletion
Critical Aruba AOS flaw CVE-2025-37168 (CVSS 8.2) allows unauthenticated file deletion & DoS. Multiple RCE bugs also patched. Upgrade AOS immediately.
Elastic patched a High-severity flaw (CVE-2025-37735) in Elastic Defend for Windows. A local attacker can delete arbitrary files via the SYSTEM service, risking privilege escalation. Update to v8.19.6+.
Synology BeeDrive desktop app for Windows has three high-severity vulnerabilities (CVSS 7.5-7.8) allowing local code execution and remote arbitrary file deletion.
A critical flaw (CVE-2025-6691, CVSS 8.8) in the SureForms WordPress plugin allows unauthenticated arbitrary file deletion (e.g., wp-config.php), leading to full site takeover.
A critical flaw (CVE-2025-6463, CVSS 8.8) in Forminator WordPress plugin allows unauthenticated arbitrary file deletion, leading to site takeover.