WordPress powers something like 40% of the web, which means every time a popular plugin gets a bad update, it's less "a bug" and more "a public health event." This week's crop: three separate plugins, three separate CVSS 9.8 scores, and the same grim punchline — unauthenticated remote code execution.
A Trifecta of "Please Don't Need a Login"
StellarWP's widely deployed The Events Calendar plugin picked up two flaws, CVE-2026-78006 and CVE-2026-78159, both allowing unauthenticated RCE — one via insecure deserialization in a function called (with tragic irony) is_safe_widget_instance, the other via insufficient validation of widget classes. Meanwhile, Everest Forms is dealing with CVE-2026-62103, an unauthenticated PHP object injection bug in versions 3.6.0 and earlier, and ThemeREX Addons has its own near-identical twin in CVE-2026-62105.
All four bugs share a CVSS score of 9.8 and a common root cause: deserializing untrusted data without checking what's actually inside it first. It's the software equivalent of accepting a package at your front door and opening it without checking who it's from, what's in the box, or whether it's ticking.
The Boring Plugin Is the One That Gets You
Nobody thinks about their events calendar or contact form plugin as "critical infrastructure" until it's the thing an attacker used to drop a webshell. These aren't obscure plugins — they're the unglamorous workhorses installed on hundreds of thousands of sites precisely because they're useful and forgettable.
The pattern worth noticing: object injection and insecure deserialization keep showing up because PHP plugin developers are often solving business problems, not threat-modeling their form handlers. That's not a knock on any individual developer — it's a reason why plugin security needs to be someone's actual job, not an afterthought bolted onto a feature release.
Your contact form shouldn't be a backdoor. If it currently could be, that's this week's homework.
Auditing which plugins are quietly running outdated, exploitable code on your site is exactly the kind of unsexy-but-essential work WTK builds into every engagement — let's take a look at what's actually installed on yours.
Source: CVE Brief