10 WordPress plugin flaws, 200,000-site PrettyLinks included — all already patched (CVE-2026-9273)

Ten WordPress plugin vulnerabilities were published together on August 5, 2026. The heaviest sits in Kadence Memberships, a membership plugin: an attacker who is not logged in can hijack the password reset flow for an administrator account. The identifier is CVE-2026-9273, rated CVSS 9.3 out of 10.

There is a calming thread running through all ten. Every one of them already has a released fix. And not released today — the fix for Kadence Memberships shipped on May 26, and Dokan's on May 21. Only the identifier is new. The holes themselves were closed two and a half months ago.

Which means the sites at risk are the ones running with automatic updates switched off. Open the dashboard, check whether updates have piled up, and the matter is closed. That said, the list includes PrettyLinks at 200,000 sites and Relevanssi at 100,000, so the number of sites sitting on old versions is unlikely to be small.

What is affected, and what to do

All ten are laid out below so you can check your own site at a glance, ordered with the no-login-required entries first. Install counts are approximate figures pulled from the official WordPress.org API; current versions and update dates were checked the same day (August 5).

Sort by severity and the most widely installed plugin lands at the bottom. Work down a list ordered by score and the one running on 200,000 sites comes last. Meanwhile the 9.3 entry, Kadence Memberships, sits on 9,000. Severity and reach have to be read separately.

Who goes after this, and what gets lost

Vulnerabilities of this shape are picked up by attackers who are not after anyone in particular, but sweep mechanically for sites that match. Plugin names and versions are visible from outside a site to a useful degree. Compile a list of "sites running this plugin at this version," then work down it. Almost no manual effort is involved.

What they want is one administrator account, and with it, ownership of the site. The Kadence Memberships issue is exactly that, entering through the password reset door that is open to everyone by design. Captured sites get turned into fake storefronts, relays for deceptive advertising, or staging posts for attacks elsewhere.

What is lost differs between the operator and the visitor. The operator loses the site and whatever has accumulated inside it — member names and email addresses on a membership site, order histories on a shop. Visitors get caught up in it through information they entered in good faith ending up somewhere else. The usual way anyone finds out is that somebody else points it out. We covered a case where exploitation actually began, Kirki, on 500,000 sites — that one also came in through password reset.

Four that need no login

CVE-2026-9273: hijacking an administrator's password reset in Kadence Memberships

The heaviest of the ten. Kadence Memberships gates posts and features behind a paid membership; it was previously called "Restrict Content." Versions 4.0.0 and below are affected.

The mechanism: when someone requests a password reset, the site emails them a reset link. The site address used to build that link was assembled from a value the requester controlled. An attacker requests a reset against the administrator's account and points the link at their own server. The administrator receives a genuine-looking email from their own site, and the moment they click the link, the reset key lands in the attacker's hands.

The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. PR:N means the attacker needs no login; UI:R means the victim has to click. Not fully hands-off, then — but what arrives is a real email from their own site. There is very little reason to doubt it.

The fix, 4.0.1, shipped on May 26. The changelog says "Strengthened security measures for password recovery," with no CVE number. It went out quietly as an ordinary update.

CVE-2026-15918: reading the database through VikAppointments' review list

A booking plugin for salons and clinics. The field controlling the sort order of the public review list was folded straight into a database query. CVE-2026-15918, rated 7.5, with no login and no special privileges required. Being a booking system, what sits inside is customer names, contact details and visit histories. 1.2.19 and below are affected; fixed in 1.2.20.

CVE-2026-16143: planting something in VikRentItems' booking form

A rental management plugin from the same developer. CVE-2026-16143, rated 7.2. The email field of the booking checkout form accepts text that runs as instructions when displayed. Because the content is stored, it runs in the browser of whoever reviews the booking in the admin screen. 1.2.1 and below are affected; fixed in 1.2.2.

CVE-2026-8790: Football Pool reflects input straight back

A plugin for running football prediction pools. CVE-2026-8790, rated 6.1. Content from the shoutbox field was echoed back into the page when a submission failed. The attack works by getting someone to follow a crafted link. 2.13.4 and below are affected, and the fix, 2.13.5, shipped on May 20 — the oldest fix in this batch.

Five that need an account

CVE-2026-8761: vendors can operate on other user accounts in Dokan

Dokan turns a WooCommerce shop into a multi-vendor marketplace. Installs: 30,000+. CVE-2026-8761, rated 8.8.

The customer endpoint was missing its authorisation check, leaving anyone registered as a vendor able to read, modify and delete other users — administrators included. A marketplace exists precisely to hand vendor accounts to people you do not know. On this product, "an account is required" is barely a barrier at all.

The fix is 5.0.3, which weDevs released on May 21. The note reads "Restricted the Customers REST endpoint to self-service to prevent vendors from modifying other user accounts" — again with no CVE number and no mention of security. The current version is 5.0.12.

CVE-2026-7753: Cost Calculator Builder exports the payment keys too

Rated 6.5, mid-table — but what walks out the door is heavy. CVE-2026-7753. The settings export routine in this quote-form plugin was missing its capability check.

What it takes is subscriber-level access — on a site with open registration, that is the state you are in the moment you sign up. And the settings that can be exported include the secret keys connecting the site to Stripe, PayPal and other payment services. The site itself is not taken over, but this is close to handing someone the back door to payments. 3.6.17 and below are affected; the current version is 4.0.14.

CVE-2026-15941: probing hidden content through Relevanssi's search

The second most widely installed plugin here, a site-search improvement running on 100,000+ sites. CVE-2026-15941, rated 6.5. In the admin search feature, taxonomy values were passed into database queries without being parameterised. Contributor-level access is enough, which puts multi-author sites in scope. The free version is affected through 4.27.1 and the premium version through 2.30.2.

CVE-2026-11421: WP ERP's filter parameter reaches the database

A business plugin bundling HR, accounting and CRM. CVE-2026-11421, rated 6.5. The CRM filter parameter was insufficiently escaped. 1.17.4 and below are affected; the current version is 1.17.7. The developer is weDevs, the same company behind Dokan — two of this batch's ten come from one vendor.

CVE-2026-18322: for Smart Popup, the sources disagree on privileges

This is the one entry where the published information contradicts itself. CVE-2026-18322, rated 8.8.

The description goes as far as spelling out the route: collect the one-time token contained in a public subscription confirmation email, then use it to send a crafted request to the admin AJAX endpoint. On that route, no login is indeed required. The vector looks like the part that has not caught up, though we cannot state that as fact.

Either way the action is identical: if you are on 1.12.0 or below, move to 1.13.0. That fix shipped on July 31.

CVE-2026-5062: PrettyLinks needs administrator access

At 200,000+ installs, the most widely used plugin in this batch, used to shorten links and count clicks. CVE-2026-5062, rated 4.9 — the lowest of the ten. The search field on the listing page was insufficiently escaped before reaching the database.

It requires administrator access. An administrator can already do anything on the site, so this alone grants nothing new, which is why the score stays at 4.9. It does, however, extend the damage once one administrator account has been taken. 3.6.20 and below are affected; the current version is 4.0.14.

The fixes went out long ago

The thing most worth taking from this batch is not any individual entry. It is the gap in time.

There is a reason for the gap. Whoever finds a flaw tells the developer first. The developer fixes it and ships, waits for the update to reach users, and only then is the detail published. Publication is delayed in order to protect the sites that have not patched yet. These ten followed that process as intended.

The flip side is that risk goes up from this moment onward. What the holes are and where they live is now public, so sweeping for matching sites is something anyone can do. Two and a half months since the fix means any site that has not updated in that window is now on the list being swept.

Note too that reading the changelogs will usually not tell you a security fix has happened. Dokan wrote "Restricted the Customers REST endpoint to self-service." Kadence Memberships wrote "Strengthened security measures for password recovery." Neither carries a CVE number; both read as routine improvements. A process built on reading changelogs will not catch these. Which leaves applying updates promptly as the only answer that works.

What to do

Open the WordPress dashboard and check the updates panel. If anything from the table above is listed, apply it. All ten have released fixes, so updating settles it. None of them is abandoned or left without a patch.

Sites without automatic updates enabled should take this as a prompt to revisit that setting; it can be switched on per plugin from the right-hand column of the plugins list. A fix sitting unnoticed for two and a half months, as here, is an entirely ordinary occurrence.

Sites that accept member or vendor registration need one step further. The Dokan and Cost Calculator Builder issues are both usable by anyone holding an account. Where the whole point is to hand accounts to strangers, "requires a login" is not a wall. Check your user list for administrator accounts you do not recognise.

For related batches, see our coverage of the 27 disclosed on August 3 and the 27 that included six plugins pulled from distribution entirely.

Summary

Ten WordPress plugin vulnerabilities were published on August 5, 2026. The heaviest is Kadence Memberships (CVE-2026-9273, 9.3), where an administrator's password reset can be hijacked. The widest reach belongs to PrettyLinks at 200,000 sites, followed by Relevanssi at 100,000.

All ten have released fixes, and none has been abandoned. The earliest fix shipped on May 20 — only the identifier is new. Sites that keep up with updates are already covered.

Severity and reach point in opposite directions here, which is the other thing worth noting. The 9.3 entry runs on 9,000 sites; the 4.9 entry runs on 200,000. Work down by score and the most widely deployed plugin comes last. Deciding by what is actually installed on your own site is the reliable route.

Frequently asked questions

Am I fine if I keep up with updates?

All ten have released fixes, so a site on current versions is already covered. Compare the "Current" column above with what your site is running.

Is any of this being exploited?

No reports of exploitation for any of the ten as of August 5, and none appears in the US government's catalogue of vulnerabilities known to be under attack. But they were published only today, and the sweeping starts now. Our CISA KEV dashboard explains how to read that catalogue.

Should I remove the plugins?

No need — every one of these has a fix. That said, if you have plugins active that you no longer use, deactivating and deleting them now reduces your exposure the next time a batch like this lands.

Can I ignore PrettyLinks at 4.9?

The score is low because exploitation requires administrator access. It will not lose you the site on its own, but it widens the damage after an administrator account is taken by some other route. Update it if you can.

How would I know if my site was hit?

Check whether any unfamiliar administrator has appeared in the user list, and whether posts you did not write have appeared. Those are the two changes that show up first when this kind of entry point is used.

References

• ▸NVD CVE-2026-9273 (Kadence Memberships)
• ▸NVD CVE-2026-8761 (Dokan)
• ▸NVD CVE-2026-18322 (Smart Popup by Supsystic)
• ▸NVD CVE-2026-15918 (VikAppointments)
• ▸NVD CVE-2026-16143 (VikRentItems)
• ▸NVD CVE-2026-7753 (Cost Calculator Builder)
• ▸NVD CVE-2026-15941 (Relevanssi)
• ▸NVD CVE-2026-11421 (WP ERP)
• ▸NVD CVE-2026-8790 (Football Pool)
• ▸NVD CVE-2026-5062 (PrettyLinks)
• ▸Dokan v5.0.3 release notes (weDevs) (May 21, 2026)
• ▸Kadence Memberships changelog (readme.txt) (entry for 4.0.1)
• ▸WordPress.org plugin directory (install counts, current versions and update dates retrieved August 5, 2026)
• ▸Wordfence Threat Intelligence (CNA for all ten)