Issue of Nov 6, 2026

Flaws worth knowing

CryptoPayment Gateway: 10 out of 10, no patch, under attack. NVD confirms CVE-2026-81648 (CVSS 10.0): a missing authorization check on an AJAX endpoint of the WordPress plugin, versions 1.2.1 to 1.2.2, lets an unauthenticated attacker delete server files, rewrite payment-gateway configuration and read stored wallet keys in cleartext. Pulled from the official directory on August 28, the extension has no fixed release and still sits on roughly 1,845 sites. Active exploitation attempts were observed in the wild from November 3. The only remedy: remove the plugin, even if deactivated, and rotate the keys.

Forms and a WooCommerce guard: two critical breaches in 24 hours. CVE-2026-118423 (10.0, published November 6): WP Libre Form 1.5.0.1 does not validate the file type submitted through its forms, so a visitor can upload PHP code. CVE-2026-100109 (9.8, published November 5): Security For WooCommerce 1.0.10 through 1.0.16 allows unauthenticated account creation through an unprotected action. The contact form becomes a webshell entry point; the security plugin becomes the account-takeover vector.

ModSecurity, the WAF that now needs defending. Two flaws rated 8.6 (CVE-2026-104269, CVE-2026-73856) hit the ModSecurity engine from 3.0.0 to 3.0.17, in multipart request handling and transaction comparison logic; version 3.0.17 fixes both, published November 5. Standing in front of booking endpoints behind Apache or nginx, it cannot be trusted to enforce its own rules until it is upgraded.

Trends

WordPress: the update window is still the attack window. CISA confirmed active exploitation on November 4 of CVE-2026-119977, the core race condition added to KEV on November 3. Wordfence counted 12,632 blocked attempts in 24 hours, and its WAF rule reaches free-tier sites only on November 27: hotel microsites still on 4.7 through 7.1.3 stay exposed three more weeks during their own updates. The US federal remediation deadline is November 6. The advice from November 3 holds: block wp-content/upgrade before the upgrade, by command line where possible.

Settlement is the new soft spot of payment platforms. Three treasury incidents in 72 hours, none with a security dimension. Toast acknowledged on November 5 that some deposits for November 3-4 sales had not reached customers, with normalization promised by end of day. Worldpay reported a two-business-day funding delay on PayPal Direct transactions, root cause identified as third-party (INC0716317, closed November 6), plus two authorization incidents on November 5 across its worldwide gateway. Adyen has still not resolved, open since November 2, missing or changed payout descriptors for a subset of clients, which triggers false fraud inquiries and reconciliation gaps. None is a breach; each cuts visibility into settled cash.

On the wire

IHG: the leak site republishes a warning. The BYOD group, which had withdrawn its data on Thursday, posted a "First and Final Warning" against IHG Hotels & Resorts on November 5, dated on the hospitality leak-site watch. No statement from the group. The phishing vigilance recommended yesterday still applies.

Omni Hotels named on a leak site. The ransomware group Redact published a listing for Omni Hotels & Resorts on November 5. Claim only, no group statement to date, attribution unconfirmed. Worth monitoring through the usual verification steps.

OPNsense: configuration injection rated 8.1. CVE-2026-57154, published November 3, lets an authenticated user with delegated access inject lines into privileged service configuration files. Fixed in 26.1.11 and 26.4.1p1. This firewall, often used to separate guest Wi-Fi from card systems, warrants the upgrade and a review of partial-privilege accounts.