Do Son WordPress pre-auth RCE CVE-2026-63030 chains a REST batch bug with SQL injection. Details and a public PoC are out. Update to WordPress 7.0.2 now.
REST API
Active exploitation alert: The PolyShell flaw in the Magento REST API allows unauthenticated RCE via malicious images. Learn how to protect your store now.
ddos-admin Discover CVE Watchtower's new enterprise suite featuring 30-day threat analytics, predictive EPSS scoring, Jira/ServiceNow webhooks, and a private REST API.
Splunk warns of a high-severity RCE flaw (CVE-2026-20163) in its REST API. Attackers with edit_cmd rights can execute arbitrary commands. Patch immediately.
A maximum-severity HPE OneView flaw (CVE-2025-37164) bypasses auth to execute code via the ID Pools API. Upgrade to v11.00 or apply hotfixes now.
Wordfence warned of a massive RCE campaign (8.7M+ attacks) exploiting flaws in GutenKit/Hunk Companion plugins. Unauthenticated attackers can install malicious plugins via vulnerable REST API endpoints.
A critical SQL injection flaw (CVE-2025-58450) in pREST allows attackers to read sensitive files, steal credentials, and manipulate databases. Patching is urgent.
Over 10,000 WordPress sites at risk from Eventin plugin flaw CVE-2025-47539. Attackers can gain admin access via unauthenticated API exploit.