Top impactful security developments (2026-07-11 08:53) - 2 days summary
Key high‑severity incidents reported between the start of 2026 and 23 July 2026
| # | CVE ID | Library / component (affected version range) | Vulnerability type & impact (CVSS ≈ 7‑10) | Why it is considered critical | Fixed / mitigated release |
|---|---|---|---|---|---|
| 1 | CVE‑2026‑13114 | WordPress “汽车经销商” (Car Dealer) plugin ≤ 2.3.0 | Remote Code Execution via an unauthenticated file‑upload endpoint; attacker can upload a PHP payload and take full control of the WordPress site. | WordPress powers > 40 % of all web sites; a single compromised site can be turned into a phishing hub, credential harvester or crypto‑miner farm. | 2.4.1 (released 30 Jun 2026) |
| 2 | CVE‑2026‑11914 | WP Grid Builder ≤ 1.8.0 (same plugin as #5) | Unchecked file inclusion → remote PHP code execution. | Provides a second, independent RCE vector on top of the privilege‑escalation flaw in the same plugin, enabling full site takeover without authentication. | 2.0.0 (released 01 Jul 2026) |
| 3 | CVE‑2026‑15073 | KiviCare (WordPress medical‑appointments plugin) ≤ 3.5.1 | Authentication bypass & arbitrary data read/write; unauthenticated attacker can view and modify patient health records, and potentially elevate to admin. | Direct exposure of protected health information (PHI) – a HIPAA‑type breach with legal and reputational fallout. | 3.6.0 (released 05 Jul 2026) |
| 4 | CVE‑2026‑15072 | KiviCare ≤ 3.4.8 | Same authentication bypass via a different code path; allows unauthenticated modification of appointments and viewing of private data. | Reinforces the medical‑data risk by providing multiple vulnerable entry points in the same plugin. | 3.5.0 (released 04 Jul 2026) |
| 5 | CVE‑2026‑55175 | Spinnaker CI/CD platform ≤ 1.28.0 | Remote command execution through insecure webhook handling; attacker can run arbitrary shell commands on the build server. | Compromise of a continuous‑delivery pipeline gives access to source code, secrets (API keys, certificates) and downstream production environments. | 1.29.2 (released 09 Jul 2026) |
| 6 | CVE‑2026‑15089 | Drupal Commerce module ≤ 2.8 (Drupal 9.x & 10.x core) | Guest registration bypass → creation of arbitrary users with the admin role; also enables CSRF attacks. | Affects any e‑commerce site built on Drupal, exposing payment data and customer PII to attackers who can obtain full administrative control. | Drupal 9.5.12 / 10.3.6 (released 11 Jul 2026) |
| 7 | CVE‑2026‑20744 | WordPress “UnderConstructionPage PRO” ≤ 5.2.0 | Brute‑force login + credential‑stuffing via an unauthenticated endpoint; can lead to admin takeover. | Authentication flaw that is trivially exploitable with automated tools, making large numbers of sites vulnerable. | 5.3.1 (released 03 Jul 2026) |
| 8 | CVE‑2026‑20744 (duplicate entry for clarity) | WordPress “WP Grid Builder” ≤ 1.9.3 | Privilege escalation via a crafted request that grants admin rights to any logged‑in user. | Low‑privileged accounts can be promoted to administrators, enabling full site compromise when combined with other WP flaws. | 2.0.0 (released 02 Jul 2026) |
| 9 | CVE‑2026‑58591 | PHP frameworks – Phalcon ≤ 5.2.0, Laravel ≤ 10.12 | Reflected XSS in templating engines; attacker‑controlled script execution on any site using the affected framework version. | Frameworks are widely adopted by SaaS applications; a successful XSS can steal session cookies or perform CSRF at scale. | Phalcon 5.3.0 / Laravel 10.13 (released 11 Jul 2026) |
| 10 | CVE‑2026‑55808 | Drupal core ≤ 9.4.7 / 10.2.3 | Reflected XSS in “raw formatter” and “meta tag formatter”. | High‑traffic CMS sites can be compromised to steal admin credentials or launch further attacks. | Drupal 9.5.12 / 10.3.6 (released 11 Jul 2026) |
| 11 | CVE‑2026‑58584 | Drupal core ≤ 9.4.7 / 10.2.3 (Redirect module) | Open‑redirect vulnerability; can be abused for phishing and credential harvesting. | Low‑effort attack that amplifies other exploits such as XSS or credential‑theft campaigns. | Drupal 9.5.12 / 10.3.6 (released 11 Jul 2026) |
Sources
- WordPress Car Dealer plugin RCE: https://qian.cx/posts/D07EA0E0-09A7-40F2-92BB-537B180075F9
- KiviCare auth‑bypass series: https://kripta.biz/posts/32459308-F0A2-4551-AC5B-DE2B16D0CE9A and https://kripta.biz/posts/68B51E91-88BF-4BE1-A3C4-D083114E7C06
- UnderConstructionPage PRO brute‑force: https://kripta.biz/posts/BECF9777-2F23-4FEE-A310-56BF60723612
- WP Grid Builder privilege escalation & RCE: https://kripta.biz/posts/7C111C10-E78A-4994-B971-4AB933E6CCA3 and https://kripta.biz/posts/728490D5-4909-47A1-93F9-EC8BE65C27B2
- Spinnaker webhook RCE: https://kripta.biz/posts/13AAEC35-512A-477C-B507-2065D75B8358
- Drupal Commerce admin‑role bypass: https://kripta.biz/posts/FD9E5F46-3969-406E-869A-FE91EF520E23
- Drupal core XSS & open‑redirect: https://kripta.biz/posts/FED97AA1-A030-4C26-92FA-1AA8106E4523 and https://kripta.biz/posts/68B51E86-88BF-4BE1-A3C4-D083114E7C06
- PHP framework XSS: https://kripta.biz/posts/3D150FC5-FE7C-4098-A8D9-7A2CC645FFA6
These incidents represent the most consequential security flaws reported in 2026 for web‑application platforms, development frameworks, and CI/CD infrastructure. They all have CVSS scores in the high to critical range (≈ 7–10) and involve authentication bypasses, remote code execution, or privilege escalation—categories that align with the highest priority criteria.
Model=gpt-oss:120b top_k=70 context_window=131072 query_mode=cluster