27 WordPress flaws at once, six with no patch: CVE-2026-16261

On August 2, 2026, 27 vulnerabilities in WordPress plugins and one theme were disclosed at once. All of them were assigned CVE identifiers by WPScan, a security research team that focuses solely on WordPress, and all were pushed into the US government vulnerability database NVD in a single batch that morning.

Three of the 27 carry a CVSS severity score of 9.8 out of 10 (critical). Those are the kind of holes where someone who knows none of your passwords simply becomes an administrator of your site. Separately, the same day also brought three flaws where a forged "Sign in with Apple" token takes over the admin account, disclosed by a different team.

The scores are not the worst part, though. Six of the 27 have no fixed version at all. And when you check each one, all six turn out to be add-ons that WordPress.org has stopped distributing. The oldest was pulled in 2018. Code abandoned eight years ago is still running on live sites, and pressing the update button will not repair it. Removal is the only option.

What the batch of 27 actually contains

Start with the numbers. The 27 issues span 26 plugins and one theme; a single event-booking plugin, Event Booking Manager for WooCommerce, accounts for three of them on its own.

Calling this "27 critical vulnerabilities" would be wrong. Nineteen of them require the attacker to already hold a posting role or a registered member account, so they are not something anyone can try from outside. That said, on a publication with freelance contributors, or a site with open member registration, that prerequisite is trivially met.

One date matters here. WPScan holds back proof-of-concept details for a set period after a report. Among these 27, six have their PoC scheduled to go public on August 3 and three more on August 4. In other words, within days of this article the recipes become readable by anyone.

Also note that every CVSS score in this article comes from WPScan. NVD has all 27 records in "awaiting analysis" status with no NVD score and no CWE assigned as of August 2, so the numbers may move once NVD finishes its own assessment.

Who goes after this, and what they do with it

When a batch lands like this, the first movers are operators who feed the published list straight into a crawler and mechanically collect whichever sites still match. They are not picking a target company; they are sweeping the entire web for sites that left a listed add-on installed and unpatched. From the victim's side, neither fame nor size has anything to do with it.

What happens next depends on the flaw. With one of the three admin-level holes, the attacker will plant a private administrator account as a back door, bury hidden pages aimed at search engines, or swap the destination of payments. With a read-type hole, the prizes are the member list and the integration keys — here, that means a booking plugin from which the entire appointment list can be pulled, and a photo-gallery plugin whose linking keys are readable from outside.

The damage does not stop at the site owner. What gets pulled out of a dental clinic or a hair salon booking form is not the shop's data but the name, phone number and appointment time of the person who booked. People who merely registered as members get funnelled into fake login screens on a compromised site. That is why confirming whether your own site is in scope comes first.

The three rated 9.8

Here are the three rated "an attacker with no login can become an administrator." Three different researchers found them, yet all three broke in the same place: the identity check itself.

CVE-2026-15206: an SMS "verified" stamp that works for someone else's number (SMS Alert)

The plugin is SMS Alert, used with the WooCommerce shop platform to send order notifications by SMS and to confirm identity with a six-digit one-time code sent to a mobile number. It sits on roughly 3,000 sites.

The break is in what happens after the code checks out. According to the CVE record, versions before 3.9.8 set a "this visitor has verified a mobile number" flag in the session but never tied that flag to which number was verified. So an attacker can have a code sent to their own phone, enter it correctly, collect the verified stamp, and then submit somebody else's number to the login handler.

The result: they can become any user who has a billing phone number on file, administrators included. It is like collecting a "identity confirmed" token at a counter and then walking back with a different name. The finder was Sai Praneeth Koti, and the WPScan entry rates it 9.8. The fix is 3.9.8, available from the official directory, so this one is a few clicks from the admin screen.

Earlier in 2026 the same plugin had a privilege escalation through password reset (CVE-2026-11387), for which working code is already public. A repeated pattern of broken identity checks in one plugin is worth weighing when deciding whether to keep it.

CVE-2026-16261: password reset with no key check, so anyone can be anyone (Huge IT Login)

The second is a plugin that added social sign-in. Its name is recorded inconsistently: the WPScan entry calls it "Huge IT Login," WordPress.org lists it simply as "Login," and the internal slug is login-social. Affected versions are 1.0.4 and below, which is also the final release of this plugin.

Two things were broken. First, the password-reset handler checked neither the reset key nor the requester's identity. Normally the link in a "forgot password" email carries a single-use random string, and only whoever holds it may reset the password; that check was missing entirely. Second, login sessions were issued straight from third-party sign-in data without verifying it.

Either one on its own means anyone can rewrite the administrator's password and walk in. It is the same shape as the Kirki password-reset account takeover we covered previously. The finder is Saudi researcher Khaled Alenazi (Nxploited), who has a history of publishing working code for his WordPress findings on GitHub.

There will be no fix. WordPress.org closed the plugin on February 7, 2018, with "Guideline Violation" given as the reason, and the last update was June 2017. Nine years without anybody touching the code.

CVE-2026-16256: a bulk user-import endpoint left open to everyone (POUCO Import Users)

The third, POUCO Import Users, exists to register members in bulk from a list file. Affected versions are 1.0.0 and below — again, the final release.

The CVE record states that the internal endpoints for creating and updating accounts performed no capability check and no nonce check, and were reachable by unauthenticated visitors. On top of that, the plugin trusts the role value supplied in the request. Send "administrator" and you get an administrator. A service entrance for importing name lists, left unlocked and facing the street.

There is no fix here either. WordPress.org closed it on August 5, 2020 for "Guideline Violation," and the last update was February 2019. The finder is the same Khaled Alenazi, and the WPScan rating is 9.8.

All six unfixable ones had already been pulled from the directory

WPScan marks six of the 27 as having no known fix. Checking each one against the official directory, all six are either closed or gone from the listing. That is not coincidence — it is the reason no fix is coming.

Why would anyone still be running something the directory has pulled? Simple: an add-on already installed on your site does not disappear when distribution stops. It does not stop working either. The menu or the login button that worked yesterday works exactly the same today.

And here is the real problem. A closed add-on produces no update notice in the admin screen. Update notices come from asking the directory whether a newer version exists; if the listing is gone, there is nothing to ask. The Updates page stays clean while years-old code keeps running, and to the owner it reads as "nothing to update, therefore safe."

This has already been used in real attacks. In December 2024 WPScan reported that attackers abused a flaw in a plugin called Hunk Companion to silently install and activate the already-closed "WP Query Console" and then use its known flaw to drop a back door. In that same write-up, WPScan called closed-but-vulnerable plugins a significant vector for exploitation. The six listed above sit in exactly that position.

One of the six, Lenxel WP, is not a plugin but a theme that controls the site's appearance. Filed as CVE-2026-12586, its password-reset routine never checks who is asking, so an outsider can rewrite the administrator password. Old unused themes sitting on a server are common, so the theme list is worth a look too.

Three found in very widely installed add-ons

Three entries carry only mid-range severity but are installed on orders of magnitude more sites. For the question "does this apply to me," these are the likeliest hits.

CVE-2026-15248: a contributor can delete other people's images (Meta Box, 500k sites)

Meta Box adds custom input fields to the post editor and is on more than 500,000 sites, the largest install base in this batch. It is what builds the "distance from the station" field on a property site or the "salary" field on a job board.

Versions before 5.13.1 did not verify that the requester was allowed to delete the supplied attachment before deleting it. A user with the lowest posting role (Contributor) can therefore permanently delete images and documents uploaded by others. Nothing is stolen, so the severity stays at 5.5, but on a multi-author site the damage is real. The fix is 5.13.1; the current release is 5.14.0. Reported by Duy.

CVE-2026-14817: a contributor's post can run script in visitors' browsers (Element Pack, 100k sites)

Element Pack Addons for Elementor adds widgets to the Elementor page builder and is on more than 100,000 sites. Before 8.7.13, option values passed through certain data attributes were not sanitised before a bundled front-end library re-rendered them, so a user with contributor access could inject arbitrary JavaScript that runs in the browser of anyone viewing the page.

The fix is 8.7.13 (July 19, 2026), but the vendor changelog lists "security improved" or "security issue fixed" four times in July alone across 8.7.11, 8.7.12, 8.7.13 and 8.7.14. The current release is 8.7.14, which is the safer place to land. Reported by Pierre Rudloff.

CVE-2026-16540: every customer's appointment details readable without logging in (Simply Schedule Appointments, 60k sites)

This is the one that reaches furthest beyond the site owner. Simply Schedule Appointments handles bookings for clinics, salons and professional consultations, and is on more than 60,000 sites.

Before 1.6.12.6, a bulk appointment operation was not restricted to the requester's own records. The CVE record states that unauthenticated users can retrieve the personal data of every appointment across the site and, on premium editions, permanently delete them. What comes out is the name, contact details and appointment time of each customer — so the party harmed is not the shop but the people who booked with it.

The 6.5 rating reflects technical severity, not the weight of the data involved. The fix is 1.6.12.6; the current release is 1.6.12.13. Reported by Suleyman Huseynov.

Five more worth knowing about

From the remainder, these have the clearest shape of impact.

CVE-2026-14920 (AcyMailing, 8.6) is a newsletter plugin whose unsubscribe handling folds a supplied value into a database query without treating it as a number, letting an unauthenticated visitor probe the database. The fix is 10.11.1 (July 9). That same release also closed a separate database-read flaw reported by UK firm mySites.guru (CVE-2026-56292). Whether the two are the same underlying bug cannot be confirmed from public sources, but upgrading to 10.11.1 clears both.

CVE-2026-15385 (RT Mega Menu, 8.0) lets a plain registered member store a string in a menu item's style value that then runs in every visitor's browser — including the administrator's, which is how it turns into a takeover. Fixed in 1.5.2.

CVE-2026-15236 (Gallery for Google Photos, 7.5) stored the access and refresh tokens for the Google Photos link where unauthenticated users could read them. With those keys in hand, an attacker reaches the linked albums directly, bypassing the site. Fixed in 1.2.1.

CVE-2026-14841 (King Addons for Elementor, 7.1) echoes submitted values straight back in the post-grid filter response, so a crafted URL runs script in the browser of whoever opens it. Fixed in 51.1.76, and the vendor changelog names the reporter.

CVE-2026-16285 (Product Attachment for WooCommerce, 5.3) serves product documents by a guessable numeric ID, so even unpublished files can be pulled without logging in. If quotes or internal documents were uploaded to the same site, they are in scope. Fixed in 2.3.3.

The full list disclosed on August 2, 2026

All 27, with target, effect, the access the attacker needs, and the fixed version. "None" in the access column means it can be tried from outside without logging in.

Every severity value comes from WPScan. CVE-2025-15675 carries a 2025 year in its identifier only because the number was reserved last year; it was disclosed on August 2 like the rest.

How to check whether your site is affected, and what to do

Three steps, and the order matters.

1. Delete plugins and themes you are not using. Open Plugins → Installed Plugins and read down the deactivated ones. Deactivated files still sit on the server, and depending on the flaw they can still be reached from outside. Anything you do not recognise, or tried years ago and left behind, should be deleted now. Do the same under Appearance → Themes. The Lenxel WP theme above lives exactly here.

2. Match the names against the table above. When you find one, compare its version number with the "Fixed in" column. Anything lower is in scope. Anything installed from the official directory updates with a single click.

3. Check the six closed ones by name. This is the crux. No update notice will ever appear for them. An admin screen that says "no updates available" proves nothing. Look for these names by eye in the plugin and theme lists:

• Huge IT Login (may be displayed simply as "Login")
• POUCO Import Users
• Narrative Publisher
• Frontend File Manager
• Clever Mega Menu for Visual Composer (free edition)
• Lenxel WP (theme)

If one turns up, updating is not an option. Deactivate and then delete — that is the only fix. If you need the feature, find a maintained replacement. CVE-2026-16261 and CVE-2026-16256 in particular are rated "administrator without logging in," so remove them before you start shopping for alternatives.

If you were running any affected add-on, do not stop at updating or deleting. Check three more things: whether any unfamiliar administrator has appeared in the user list, whether booking or member data shows unusual retrieval activity, and, for the identity-check flaws, change the administrator password and regenerate the authentication salts. The broader question of how to count and retire the third-party parts you install is covered in our open-source supply chain review.

Exploitation status: confirmed versus unconfirmed

Separating what can be stated from what cannot.

No exploitation report is not the same as safe. In July, WordPress core itself had an unauthenticated takeover flaw (CVE-2026-63030 and others) used in real attacks, with broad scanning starting once working code went public. Several of today's 27 have their proof-of-concept scheduled for August 3 onward. Changes in listing status can be followed on our CISA KEV dashboard.

Summary

Of the 27 WordPress vulnerabilities disclosed on August 2, 2026, 21 are fixed by updating. Among the widely installed ones: Meta Box (500,000 sites) to 5.13.1, Element Pack (100,000 sites) to 8.7.13 or later, and the booking plugin Simply Schedule Appointments (60,000 sites) to 1.6.12.6. That last one leaks not the owner's data but the names and contact details of the people who booked, so if it applies to you it is worth handling today.

The other six are the problem. No fix is coming because development stopped; because it stopped, the directory closed the listing; and because the listing is closed, no update notice ever appears. That single detail is how code abandoned eight years ago survived until today. An empty Updates page is not proof of safety.

The action is to delete the plugins and themes you are not using. That alone clears most of the six. As ongoing practice, not leaving "installed but unused" items sitting deactivated — deleting them instead — is the cheapest habit available. We will update this article if exploitation reports or public proof-of-concept code appear.

References

• ▸ NVD - CVE-2026-15206 Detail (SMS Alert)
• ▸ NVD - CVE-2026-16261 Detail (Huge IT Login)
• ▸ NVD - CVE-2026-16256 Detail (POUCO Import Users)
• ▸ NVD - CVE-2026-16540 Detail (Simply Schedule Appointments)
• ▸ NVD - CVE-2026-15248 Detail (Meta Box)
• ▸ NVD - CVE-2026-12586 Detail (Lenxel WP theme)
• ▸ WPScan - SMS Alert < 3.9.8
• ▸ WPScan - Huge IT Login <= 1.0.4
• ▸ WPScan - POUCO Import Users <= 1.0.0
• ▸ WPScan - Simply Schedule Appointments < 1.6.12.6
• ▸ WPScan - Lenxel WP <= 1.0.31
• ▸ WPScan - Unauthorized Plugin Installation/Activation in Hunk Companion (a closed plugin abused in the wild)
• ▸ WordPress.org - login-social (closed February 7, 2018)
• ▸ WordPress.org - POUCO Import Users (closed August 5, 2020)
• ▸ WordPress.org - Frontend File Manager Plugin (closed May 27, 2026 for a security issue)
• ▸ WordPress.org - Narrative Publisher (closed June 25, 2026 pending review)
• ▸ WordPress.org - Clever Mega Menu (closed July 14, 2026 pending review)
• ▸ mySites.guru - AcyMailing SQL Injection Vulnerability (CVE-2026-56292)
• ▸ CISA - Known Exploited Vulnerabilities Catalog