Live Web Security Brief for July 28, 2026: APIs, WordPress, and Application Risk

Live web application intelligence for WordPress, APIs, authentication, authorization, injection flaws, dependencies, and browser-facing controls.

Application attack surface

Web exposure is determined by reachable routes, roles, data paths, plugin and framework versions, and compensating controls. Public exploitability and authentication requirements should guide the first response.

For July 28, 2026, the lead development is CVE-2026-60137: WordPress Core SQL Injection Vulnerability. Start by confirming where WordPress Core is deployed, who owns it, and whether the affected path is reachable. The remaining items below add the product-specific context needed to turn the headline into an owned security decision.

Web and API developments

CVE-2026-60137: WordPress Core SQL Injection Vulnerability

CISA Known Exploited Vulnerabilities | July 21, 2026 | Known Exploited | WordPress Core

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Why it matters: WordPress Core may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

CISA remediation date: 2026-08-04. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability

CISA Known Exploited Vulnerabilities | July 21, 2026 | Known Exploited | WordPress Core

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Why it matters: WordPress Core may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

CISA remediation date: 2026-07-24. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original CISA Known Exploited Vulnerabilities record

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

GitHub Advisory Database | July 25, 2026 | CRITICAL | CVSS 10.0 | GitHub Advisory Database pheditor/pheditor

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in `pheditor_password` is enough to reach the password-change form, and submitting `pheditor_new_password` / `pheditor_confirm_password` in the same request is enough to set an arbitrary…

Why it matters: GitHub Advisory Database pheditor/pheditor participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.

Open the original GitHub Advisory Database record

CVE-2026-14785: The Web Directory Free plugin for WordPress is vulnerable to generic SQL…

NIST National Vulnerability Database | July 28, 2026 | HIGH | CVSS 7.5

Continue reading the full briefing.

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already…

Why it matters: CVE-2026-14785 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original NIST National Vulnerability Database record

CVE-2026-61609: Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

GitHub Advisory Database | July 28, 2026 | HIGH | CVSS 7.5 | GitHub Advisory Database pterodactyl/panel

### Summary The `authentication` rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to…

Why it matters: GitHub Advisory Database pterodactyl/panel participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original GitHub Advisory Database record

USN-8618-1: Linux kernel vulnerabilities

Ubuntu Security Notices | July 28, 2026

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise…

Why it matters: Ubuntu Security Notices may be embedded across servers, containers, appliances, and administration hosts. Package installation alone does not prove that the corrected code is running.

What to verify: Compare distribution package versions, identify the loaded kernel or library, plan required service restarts or reboots, and validate workload health after the change.

Operational focus: Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.

Open the original Ubuntu Security Notices record

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

GitHub Advisory Database | July 25, 2026 | HIGH | CVSS 7.4 | GitHub Advisory Database org.http4s:http4s-blaze-server_2.13, org.http4s:blaze-http_2.13, org.http4s:blaze-http_3

### Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/`) cause request-boundary disagreement with a stricter intermediary. All are reachable from a default `BlazeServerBuilder` with no non-default configuration. ### Impact Actual exploitability depends on the fronting proxy — a boundary disagreement requires a *pair* of parsers that disagree. Where the proxy forwards the malformed bytes…

Why it matters: GitHub Advisory Database org.http4s:http4s-blaze-server_2.13, org.http4s:blaze-http_2.13, org.http4s:blaze-http_3 participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original GitHub Advisory Database record

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

GitHub Advisory Database | July 25, 2026 | HIGH | CVSS 8.8 | GitHub Advisory Database poweradmin/poweradmin

### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the `user_edit_others` permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2. set the password of any account, even without the `user_passwd_edit_others`…

Why it matters: GitHub Advisory Database poweradmin/poweradmin participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original GitHub Advisory Database record

Application response plan

Confirm that the affected route or component is actually enabled, then patch the permanent cause. Use temporary filtering only as a bridge and review requests for evidence of attempted abuse.

Inventory WordPress core, plugins, themes, frameworks, and public API versions.
Prioritize unauthenticated injection, authorization bypass, file access, and remote execution paths.
Patch affected components and remove unused or abandoned extensions.
Review web, application, authentication, and administrative change logs for abuse.
Validate security headers, least-privilege roles, backups, and recovery after remediation.

Requests and control signals

Check route reachability, authentication state, roles, request patterns, component versions, and recovery readiness.

Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.
Patch the component, test authentication and authorization boundaries, and review suspicious requests.
Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.

Web security takeaway

Permanent web risk reduction comes from fixing the vulnerable component or authorization path, then validating the result with request evidence and recovery checks.

References used in this briefing

Application attack surface

Web and API developments

CVE-2026-60137: WordPress Core SQL Injection Vulnerability

CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

CVE-2026-14785: The Web Directory Free plugin for WordPress is vulnerable to generic SQL…

CVE-2026-61609: Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

USN-8618-1: Linux kernel vulnerabilities

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Application response plan

Requests and control signals

Web security takeaway

Related briefings

CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026

CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability

Need to add context to this briefing?