Arbitrary File Upload Archives • Daily CyberSecurity

WooCommerce Wholesale Lead Capture Exploited in the Wild

WooCommerce Wholesale Lead Capture and WooCommerce Wholesale Lead Capture vulnerability diagram

WooCommerce Wholesale Lead Capture Exploited in the Wild

Do Son September 15, 2026

Attackers are actively exploiting a critical WooCommerce Wholesale Lead Capture vulnerability. Patch WooCommerce Wholesale Lead Capture now.

Super Forms Vulnerability Exploited in the Wild: 13,000 Sites Face 9.8 CVSS Remote Code Execution Super Forms vulnerability CVE-2026-14894 arbitrary file upload remote code execution exploited in the wild WordPress plugin diagram

Super Forms vulnerability CVE-2026-14894 arbitrary file upload remote code execution exploited in the wild WordPress plugin diagram

Super Forms Vulnerability Exploited in the Wild: 13,000 Sites Face 9.8 CVSS Remote Code Execution

Do Son September 4, 2026

CVE-2026-14894, a critical Super Forms vulnerability, is exploited in the wild. The 9.8 CVSS file upload flaw enables unauthenticated remote code execution.

CVE-2026-32475 (CVSS 9.8): Elementor Pro Flaw Risks Complete Site Compromise for 6 Million Sites Elementor Pro CVE-2026-32475 unauthenticated arbitrary file upload vulnerability risking complete site compromise on WordPress

Elementor Pro CVE-2026-32475 unauthenticated arbitrary file upload vulnerability risking complete site compromise on WordPress

CVE-2026-32475 (CVSS 9.8): Elementor Pro Flaw Risks Complete Site Compromise for 6 Million Sites

Do Son August 21, 2026

CVE-2026-32475 (CVSS 9.8) is an Elementor Pro arbitrary file upload flaw risking complete site compromise across 6 million WordPress sites. Update to 4.2.2.

CVE-2026-15748 (CVSS 9.8): Forminator Flaw Enables Pre-Auth RCE CVE-2026-15748 Forminator Forms unauthenticated arbitrary file upload vulnerability CVSS 9.8 pre-auth remote code execution WordPress

CVE-2026-15748 Forminator Forms unauthenticated arbitrary file upload vulnerability CVSS 9.8 pre-auth remote code execution WordPress

CVE-2026-15748 (CVSS 9.8): Forminator Flaw Enables Pre-Auth RCE

Do Son August 18, 2026

CVE-2026-15748, a CVSS 9.8 flaw in Forminator Forms, lets unauthenticated attackers upload PHP files for pre-auth RCE. Update to 1.56.2 now.

Over 400,000 WordPress Sites at Risk as “Breeze” Plugin Zero-Day Is Exploited in the Wild WordPress RCE Breeze Plugin Vulnerability

Over 400,000 WordPress Sites at Risk as “Breeze” Plugin Zero-Day Is Exploited in the Wild

Do Son April 23, 2026

Critical 9.8 CVSS RCE hits 400,000+ WordPress sites using the Breeze plugin. Attackers are exploiting arbitrary file uploads. Update to v2.4.5 immediately!

Null Byte Nightmare: Critical WPvivid Backup Flaw (CVSS 9.8) Exposes 800K WordPress Sites WPvivid Backup Vulnerability CVE-2026-1357

Null Byte Nightmare: Critical WPvivid Backup Flaw (CVSS 9.8) Exposes 800K WordPress Sites

Do Son February 11, 2026

Critical WPvivid Backup flaw CVE-2026-1357 (CVSS 9.8) allows unauthenticated file upload via null byte key. Update to v0.9.124 to prevent RCE.

CVE-2025-67968 (CVSS 9.9): Critical Flaw in Real Estate Theme Exposes 30,000 Sites to Takeover RealHomes CRM Vulnerability CVE-2025-67968

CVE-2025-67968 (CVSS 9.9): Critical Flaw in Real Estate Theme Exposes 30,000 Sites to Takeover

Do Son January 26, 2026

Critical RealHomes CRM flaw CVE-2025-67968 (CVSS 9.9) allows any logged-in user to upload malicious files. Update to v1.0.1 immediately to prevent takeover.

Critical RCE Flaw (CVE-2025-5394) in “Alone” WordPress Theme Actively Exploited, Allowing Full Site Takeover Quest KACE Vulnerability CVE-2025-32975 FortiGate SSO Bypass, Active Exploitation GoAnywhere RCE, Storm-1175 Cisco VPN RCE, ASA Zero-Day TinyColor Supply Chain Attack SK Telecom, data breach Erlang/OTP RCE, OT Network Security Ivanti CSA Attacks WordPress RCE, Theme Vulnerability

Quest KACE Vulnerability CVE-2025-32975 FortiGate SSO Bypass, Active Exploitation GoAnywhere RCE, Storm-1175 Cisco VPN RCE, ASA Zero-Day TinyColor Supply Chain Attack SK Telecom, data breach Erlang/OTP RCE, OT Network Security Ivanti CSA Attacks WordPress RCE, Theme Vulnerability

Critical RCE Flaw (CVE-2025-5394) in “Alone” WordPress Theme Actively Exploited, Allowing Full Site Takeover

Do Son July 30, 2025

A critical RCE flaw (CVE-2025-5394, CVSS 9.8) in the Alone WordPress theme allows unauthenticated attackers to upload arbitrary files and gain full site control. Exploitation is confirmed in the wild.

Critical Arbitrary File Upload Vulnerability in SonicWall SMA 100 Series Devices SonicWall ES RCE, Code Integrity Bypass SonicWall SMA, Arbitrary File Upload SonicWall SMA100 - CVE-2024-40764

SonicWall ES RCE, Code Integrity Bypass SonicWall SMA, Arbitrary File Upload SonicWall SMA100 - CVE-2024-40764

Critical Arbitrary File Upload Vulnerability in SonicWall SMA 100 Series Devices

Do Son July 23, 2025

SonicWall warns of CVE-2025-40599 in SMA 100 series, allowing authenticated admins to upload arbitrary files, potentially leading to RCE.

Cisco Patches Two Vulnerabilities in CCP and ISE: Proof-of-Concept Exploits Publicly Available Cisco Vulnerabilities, PoC Exploit

Cisco Patches Two Vulnerabilities in CCP and ISE: Proof-of-Concept Exploits Publicly Available

Do Son June 5, 2025

Cisco addresses CVE-2025-20129 and CVE-2025-20130 in CCP and ISE platforms. PoC exploits are public. Admins urged to migrate to fixed versions.