Live Web Security Brief for August 3, 2026: APIs, WordPress, and Application Risk

CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CISA Known Exploited Vulnerabilities | July 27, 2026 | Known Exploited | Fortinet FortiOS

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Why it matters: Fortinet FortiOS commonly protects an internet edge or management boundary. Exposure there can affect remote access, traffic inspection, credentials, and the trust placed in downstream systems.

What to verify: Check the running firmware and model, restrict management access, compare configuration changes and new accounts, preserve independent logs, and rotate credentials if compromise cannot be excluded.

CISA remediation date: 2026-08-10. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-8457: The WooCommerce – Social Login plugin for WordPress is vulnerable to Authentication…

NIST National Vulnerability Database | August 2, 2026 | CRITICAL | CVSS 9.8

The WooCommerce – Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined…

Why it matters: CVE-2026-8457 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original NIST National Vulnerability Database record

CVE-2026-15964: The Single Sign On For TNG plugin for WordPress is vulnerable to…

NIST National Vulnerability Database | August 1, 2026 | CRITICAL | CVSS 9.8

The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved…

Why it matters: CVE-2026-15964 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

Operational focus: Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.

Open the original NIST National Vulnerability Database record