Alertas de Seguridad de la Información

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica de takeover de cuentas en plugin TrueBooker para WordPress (CVE-2026-14364)

El plugin TrueBooker para WordPress (versiones hasta 1.2.3) permite a atacantes no autenticados resetear contraseñas de usuarios arbitrarios mediante validación insuficiente de identidad. Afecta directamente a sitios de servicios (salones, clínicas, agencias) en LATAM que usan este plugin para reservas. Un atacante podría acceder a cuentas administrativas y comprometer datos de clientes.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica de omisión de autenticación en plugin TrueBooker para WordPress

El plugin TrueBooker – Appointment Booking and Scheduler System para WordPress contiene una falla de autorización que permite a atacantes no autenticados cambiar contraseñas de cuentas administrativas en versiones hasta la 1.2.3. Esta vulnerabilidad afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan WordPress para gestión de citas y reservas, exponiendo el control total de sus sitios web.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-14812] The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a h…

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-66447] Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

Unauthenticated SQL Injection in WordPress File Upload

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65553] Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 …

Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-16054] The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not preven…

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-12713] The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a para…

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-5581] The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary me…

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-4431] The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due…

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-15360] The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter …

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-15210] The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the …

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9273] The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vuln…

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-16618] The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking …

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-15958] The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization check…

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16300] The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, all…

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16532] The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied…

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16534] The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's…

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-15930] The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed dur…

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-12965] The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthentica…

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/08/2026

Vulnerabilidad crítica de omisión de autenticación en WooCommerce Social Login

El plugin WooCommerce - Social Login para WordPress (versiones hasta 2.8.7) permite eludir la autenticación mediante el manejador de inicio de sesión de Apple, que acepta tokens sin validar la firma JWT ni verificar las claves públicas de Apple. Esta vulnerabilidad afecta directamente a tiendas en línea en México y LATAM que utilizan este plugin para gestionar accesos de clientes, exponiendo cuentas y datos de transacciones a acceso no autorizado.

nvdcriticovulnerabilidad CVSS 9.8 NVD