Live Web Security Brief for July 31, 2026: APIs, WordPress, and Application Risk

CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CISA Known Exploited Vulnerabilities | July 27, 2026 | Known Exploited | Fortinet FortiOS

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Why it matters: Fortinet FortiOS commonly protects an internet edge or management boundary. Exposure there can affect remote access, traffic inspection, credentials, and the trust placed in downstream systems.

What to verify: Check the running firmware and model, restrict management access, compare configuration changes and new accounts, preserve independent logs, and rotate credentials if compromise cannot be excluded.

CISA remediation date: 2026-08-10. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-14483: The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress…

NIST National Vulnerability Database | July 31, 2026 | CRITICAL | CVSS 9.8

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are…

Why it matters: CVE-2026-14483 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original NIST National Vulnerability Database record

CVE-2026-16236: The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File…

NIST National Vulnerability Database | July 31, 2026 | HIGH | CVSS 8.8

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes…

Why it matters: CVE-2026-16236 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.