Skip to dossier
Archived issue·09-04-2026
View latest issue
←fruition.net
verified 2w ago
The Perimeter · Issue 09-04-2026

Next.js patches, WordPress mega-plugin takeovers, and PaperCut under active exploitation

This week's signal concentrates on the surfaces Fruition operates every day: WordPress plugins with hundreds of thousands of installs shipping unauthenticated admin takeover bugs, a Next.js security release moved forward a week, and PaperCut confirming in-the-wild exploitation of its print management stack. On the CMS side, Wordfence's Argus program is now surfacing critical bugs faster than plugin vendors can rotate advisories — TranslatePress (400k sites), WPMU DEV Dashboard (350k), and Avada (1M sales) all landed in a single week. Supporting that, Pimcore disclosed a pre-auth account takeover with 2FA bypass, and a family of MariaDB connector CVEs are leaking cleartext passwords to MitM attackers even when TLS is enabled. CISA added a Citrix NetScaler memory-corruption bug to KEV. Recalculate this week: if you run WordPress at scale, assume any high-install plugin can be pre-auth-takeover class this cycle — audit your update-lag SLO and confirm your MariaDB/JDBC clients pin server certs, not just enable TLS.
Published
Friday, September 4, 2026
Entries
11
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
01

Web Application

frameworks · browsers · authentication flows

nextjs.org3w
▲ headline

Next.js August 2026 security release ships one week early

Vercel pulled the August Next.js security release forward to August 25, 2026, after identifying an additional critical severity vulnerability in an upstream dependency: an unauthenticated RCE in the Image Optimization API when handling AVIF images. Updates are available in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS). Teams should treat this as a directed patch cycle, not a routine bump.

Next.js
Fruition take

Any Next.js marketing surface we operate should be on the patched line by end of week. Confirm your build pipelines don't pin an older minor via package-lock or Docker base image.

github.com2wCVSS 8.8

Pimcore pre-auth admin takeover via password-reset URL injection bypasses 2FA

CVE-2026-55207 (CVSS 8.8) lets an unauthenticated attacker send a password-reset request with an attacker-controlled resetPasswordUrl. Pimcore generates a valid recovery token, appends it to the attacker's URL, and mails it to the victim. The reset-token login path explicitly disables 2FA, so TOTP-protected admin accounts are also fully compromised.

CVE-2026-55207CVE-2026-55208CVE-2026-55212+1 morePimcore
Fruition take

If any client runs Pimcore, patch now — 2FA does not save you. Also audit whether reset-link emails have been sent to unusual domains in the last 30 days.

portswigger.net3w

PortSwigger: unusual characters in HTML tag names yield JavaScript execution

Gareth Heyes at PortSwigger documents how browsers accept a wider range of characters after the leading `a-zA-Z` in HTML tag names than most sanitizers assume, producing new XSS bypass primitives against filters that whitelist tag names by regex. Reproducible techniques against common sanitization libraries are included.

Fruition take

If you rely on a regex allowlist of tag names anywhere in your rich-text pipeline, replace it with a parser-based sanitizer (DOMPurify with default config) and re-test with PortSwigger's payloads.

02

Supply Chain

packages · build systems · dependency attacks

github.com2wCVSS 7.5

MariaDB connectors leak cleartext passwords to MitM despite TLS enabled

A cluster of CVEs (CVE-2026-55215, -55856, -55857, -55860) in MariaDB Java, Node, and R2DBC connectors show credentials are sent before the server certificate is validated when no CA/cert is pinned, or clear-text auth plugins are accepted over plain TCP. An on-path attacker presenting any cert captures the account password even though the connection later aborts on fingerprint check.

CVE-2026-55215CVE-2026-55856CVE-2026-55857+1 moremariadb-java-clientr2dbc-mariadbmariadb-connector-nodejs
Fruition take

In K8s, TLS to MariaDB is not enough — you must pin the CA or server cert in the connection string (sslMode=VERIFY_CA with an explicit trust store on Connector/J). Audit every service that connects to MariaDB/MySQL and confirm the connector actually validates the server certificate.

krebsonsecurity.com2w

Australian police arrest two alleged TeamPCP supply-chain attackers

The Australian Federal Police arrested two men (aged 21 and 23) in Western Australia tied to TeamPCP, a group Krebs describes as running the longest-running spree of software supply chain attacks on record, publishing malicious open-source packages to compromise thousands of businesses.

Fruition take

Good time to review your npm/composer install-time controls: block postinstall on CI where feasible, and pin lockfiles across the monorepo. Arrests don't stop the technique.

03

Infrastructure

kubernetes · cloud · network · ingress

github.com2wCVSS 7.7

SeaweedFS S3 gateway path traversal breaks bucket isolation

CVE-2026-55874 (CVSS 7.7) in SeaweedFS's S3 API gateway fails to reject `..` segments in the X-Amz-Copy-Source header used by CopyObject/UploadPartCopy. An IAM identity scoped to a single bucket can read any object in any bucket on the instance — a confused-deputy authorization bypass. The prior fix (CVE-2026-54917) only hardened the URL path.

CVE-2026-55874SeaweedFS
Fruition take

If you use SeaweedFS as an S3 backend for any tenant workloads, patch immediately and search access logs for X-Amz-Copy-Source values containing `..`.

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

wordfence.com3w
▲ headline

TranslatePress account takeover exposes 400k WordPress sites

Wordfence disclosed an unauthenticated account takeover in TranslatePress (400,000+ active installs) where attackers can obtain an administrator's password reset link, reset the password, and log in as admin. Full site takeover with no authentication required. Patch is available via the vendor.

TranslatePress
Fruition take

Grep every managed WordPress estate for TranslatePress and force-update this week. If you rely on staged plugin rollouts, this is the class of bug that justifies breaking the schedule.

wordfence.com2w

WPMU DEV Dashboard auth bypass grants admin when Hub SSO is enabled

Wordfence's Argus discovered an authentication bypass in WPMU DEV Dashboard (est. 350,000 installs) reachable when Hub Single-Sign On is enabled. Unauthenticated attackers can obtain administrator access, leading to site takeover and RCE via the plugin/theme editor. Vendor patch is out.

WPMU DEV Dashboard
Fruition take

If any multisite hub uses WPMU DEV Dashboard, disable Hub SSO until patched and rotate any Hub tokens. Then audit users table for freshly created admins.

wordfence.com3w

Avada theme (1M sales) hit by 6-step critical RCE chain

Wordfence Argus chained six issues in the Avada theme (one of the most-sold ThemeForest products with roughly one million sales) into a critical remote code execution. Patch is available; details of the chain are published by Wordfence.

Avada theme
Fruition take

Avada is common on legacy WordPress builds we inherit. Add theme version to your discovery scans and patch alongside plugins this cycle.

05

Identity & Auth

oauth · saml · iam · session attacks

no entries this week

06

Threat Intel

active exploitation · breaches · ransomware

therecord.media2wCVSS 9.4

PaperCut NG/MF under active exploitation, emergency advisory issued

PaperCut published an emergency advisory confirming that CVE-2026-82078 (CVSS 9.4) and CVE-2026-81578 (CVSS 8.8) in PaperCut NG and MF print management are being exploited in the wild. PaperCut has prior KEV entries from the 2023 Bl00dy and Clop campaigns and is common on airport, government, and enterprise networks, the exact surface Fruition operates against.

CVE-2026-82078CVE-2026-81578PaperCut NGPaperCut MF
Fruition take

For airport and public-sector clients, treat PaperCut instances as internet-exposed even if 'internal.' Patch this week and restrict the web interface to trusted IP ranges, exactly as the vendor advisory recommends; egress-block the print server if you can't patch immediately.

nvd.nist.gov3wKEVCVSS 9.8

Citrix NetScaler ADC/Gateway memory-corruption bug hits KEV

CISA added CVE-2026-8452, a memory-overflow vulnerability (CVSS 9.8) in Citrix NetScaler ADC and Gateway, to KEV. NVD lists denial of service as the impact when the appliance is configured as a Gateway or AAA virtual server, but NetScaler's recent history of exploited bugs means any KEV addition warrants immediate attention on internet-facing appliances.

CVE-2026-8452Citrix NetScaler ADCCitrix NetScaler Gateway
Fruition take

Client-facing NetScaler tenants should be on the vendor-fixed build within the BOD deadline. If you're still deferring the July NetScaler cycle, stop.