On October 16, 2026, NVD published six CVEs rated 9.8 in WordPress plugins. What they share: none requires an account on the site. An anonymous visitor is enough.
The flaw classes differ — privilege escalation, file upload, account takeover, PHP object injection — but in most cases the outcome is the same: full control of the site, either through an administrator account or through code execution on the server.
| Plugin | CVE | Flaw class | NVD bounds |
|---|---|---|---|
| My Calendar | CVE-2026-104798 | Privilege escalation | ≤ 3.8.7 |
| Mang Board | CVE-2026-109219 | Arbitrary file upload | ≤ 2.4.4 |
| MailOptin | CVE-2026-109515 | Account takeover | ≤ 1.2.78.6 |
| ELEX HelpDesk | CVE-2026-103768 | Arbitrary file upload | ≤ 3.3.7 |
| Theme My Login | CVE-2026-89079 | Account takeover (multisite) | ≤ 7.2.1 |
| Sunshine Photo Cart | CVE-2026-104730 | PHP object injection | ≤ 3.7.4 |
All of them: CVSS 3.1 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, NVD published October 16, 2026, none in CISA KEV as of writing. These are NVD bounds ("up to and including"): NVD doesn't name the fixed release. Check the plugin page or vendor advisory before treating a version as safe.
My Calendar — CVE-2026-104798
An event management plugin. An unauthenticated attacker can make the plugin call arbitrary PHP functions, which allows overwriting the credentials of the initial administrator account and gaining full wp-admin access.
Exposure condition: it's reachable through the public calendar page the plugin creates by default on activation. In other words, any site with My Calendar active is exposed.
Action: upgrade past 3.8.7 as soon as a fixed release is available; otherwise deactivate the plugin.
Mang Board — CVE-2026-109219
A forum / bulletin board plugin. Extension validation doesn't cover every field of the upload: an unauthenticated attacker can drop a potentially executable file, and so run code on the server.
Exposure condition: the board must accept guest posts — the plugin's default mode.
Action: upgrade past 2.4.4. Meanwhile, disable guest posting and block PHP execution in the uploads directory.
MailOptin — CVE-2026-109515
A signup form and newsletter plugin. Missing validation lets an unauthenticated attacker change the password of any existing account, administrators included.
Exposure condition: a "WordPress User Registration" opt-in form must be published somewhere on the site. Check the type of each of your MailOptin forms.
Action: upgrade past 1.2.78.6. Meanwhile, unpublish MailOptin user registration forms.
ELEX HelpDesk — CVE-2026-103768
A ticketing plugin. Attachments from emails fetched over IMAP are saved without sufficient file type checks: an attacker who sends an email to the polled mailbox can drop a potentially executable file.
Exposure condition: IMAP ticket fetching must be configured. The entry point is then a plain email address, usually public by design (support@…).
Action: upgrade past 3.3.7. Meanwhile, disable IMAP polling and block script execution in the directory where attachments are stored.
Theme My Login — CVE-2026-89079
A login page customisation plugin. The user's identity isn't properly verified before a password change: arbitrary account takeover.
Exposure condition: multisite installations, in certain configurations NVD doesn't detail. A single site is presumably not affected, but check the vendor advisory.
Action: upgrade past 7.2.1 on any multisite network.
Sunshine Photo Cart — CVE-2026-104730
A client gallery plugin for photographers. Deserialisation of untrusted input: unauthenticated PHP object injection.
Impact condition: NVD states that no known POP chain exists in the plugin itself. The flaw only has impact if another installed plugin or theme provides one — in which case file deletion, data theft or code execution become possible. The 9.8 describes that worst case.
Action: upgrade past 3.7.4. Don't dismiss the condition: on a site with many plugins, you don't know whether a usable chain exists.
Detection
- Administrator accounts: list them, compare against what you expect, check password change dates — especially the original administrator (ID 1).
- PHP files in
wp-content/uploads/: there should be none. - wp-admin logins from unknown IPs, or password resets nobody asked for.
- Access logs: spikes of anonymous requests to the affected plugins' public pages.
For a comparable precedent, see our article on four critical WordPress plugins from May 2026.
General Mitigation
- Identify sites running any of these six plugins (
wp plugin liston each instance). - Upgrade to a release past the NVD bounds as soon as the vendor ships it; otherwise deactivate the plugin.
- Block PHP execution in
wp-content/uploads/at the web server level: it neutralises a large share of upload flaws, present and future. - When in doubt: reset administrator passwords, rotate the keys and salts in
wp-config.php, audit recently modified files.
Why Continuous Monitoring of Your WordPress Plugins Matters
Six plugins, six flaw classes, six different exposure conditions, published the same day. Across a fleet of WordPress sites, the only useful question is "which of my sites runs which of these plugins, at which version" — and it needs an answer before exploitation starts.
With cveo.tech, inventory your WordPress plugins with their versions and get alerted whenever a critical CVE hits them.