Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-19598] The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalatio…

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON met…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de takeover de cuentas en plugin TrueBooker para WordPress (CVE-2026-16142)

El plugin TrueBooker para WordPress (versiones hasta 1.2.6) permite el robo de cuentas de usuario debido a que el manejador AJAX add_front_user_update() acepta parámetros arbitrarios sin validar autenticación ni propiedad, permitiendo a atacantes modificar cuentas administrativas. Esta vulnerabilidad afecta a miles de sitios WordPress en LATAM que utilizan este plugin para gestión de reservas. El riesgo es crítico (CVSS 9.8) ya que facilita comprometer la integridad completa del sitio.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Bypasa de autenticación en User Profile Builder para WordPress (CVE-2026-15826)

El plugin User Profile Builder para WordPress versiones hasta 3.16.4 contiene una vulnerabilidad crítica (CVSS 9.8) que permite bypasear autenticación mediante confusión de tipos en la función wppb_log_in_user(). Un atacante puede registrarse con nombres de usuario de 61-70 caracteres para eludir validaciones y acceder sin credenciales válidas. Afecta directamente a sitios WordPress en empresas LATAM que dependen de este plugin para gestión de usuarios y control de acceso.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica en plugin RapiSafe para WordPress permite eliminación arbitraria de archivos

El plugin RapiSafe – Secure Multi File Upload for Contact Form 7 en WordPress (versiones ≤1.0.4) contiene una falla de validación de rutas que permite a atacantes no autenticados eliminar archivos arbitrarios del servidor. Esta vulnerabilidad puede escalarse a ejecución remota de código, comprometiendo sitios web de empresas en México y LATAM que utilicen este plugin. El riesgo es crítico especialmente en entornos de comercio electrónico y sitios corporativos expuestos a Internet.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin 6Storage Rentals para WordPress

El plugin 6Storage Rentals para WordPress (versiones hasta 2.27.0) contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes eludir la autenticación y acceder a cuentas de usuarios sin credenciales válidas. La falla reside en el manejador AJAX six_storage_create_wp_user() que se ejecuta sin validar tokens de seguridad, permisos ni propiedad de usuario, permitiendo la ejecución de funciones sensibles como wp_set_current_user() y wp_set_auth_cookie(). Afecta principalmente a sitios WordPress con comercio electrónico o alquileres en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin User Session Synchronizer para WordPress (CVE-2026-15341)

El plugin User Session Synchronizer para WordPress en versiones hasta 1.4.0 contiene una vulnerabilidad de bypass de autenticación (CVSS 9.8) que permite la toma de control de cuentas sin validación de nonce, permisos o secretos compartidos. Un atacante puede explotar parámetros sin protección (`ussync-key`, `ussync-token`, `ussync-ref`) ejecutados en cada solicitud para secuestrar sesiones de usuarios, incluidas administrativas. Afecta directamente a medianas y grandes empresas en LATAM que alojan WordPress en infraestructura local o en la nube con este plugin activo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-12949] The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verifica…

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-15413] The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it …

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-14182] The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly val…

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18391] The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unse…

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18366] The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, di…

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16538] The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collec…

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16051] The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages inst…

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-15039] The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of i…

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-16230] The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insuffi…

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-19053] The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter bef…

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/08/2026

Plugin AI Copilot – Content Generator para WordPress vulnerable a bypass de autorización

El plugin AI Copilot – Content Generator en WordPress (versiones hasta 1.5.6) presenta una vulnerabilidad crítica de bypass de autorización (CVSS 9.8) que permite a atacantes no autenticados crear cuentas de administrador y comprometer completamente el sitio web. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan WordPress para presencia digital y e-commerce.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-16258] The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrust…

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-16038] The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway …

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-14205] The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when re…

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

nvdcriticovulnerabilidad CVSS 9.8 NVD