5 vulnerabilities across 5 products scored HIGH or above on August 15, 2026.

  • 🟠 HIGH: 5

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-17083 (ibm/i) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-08-12 bulletin.
  • [UPGRADED] CVE-2026-72886 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-72882 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-72901 (dokploy/dokploy) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-08-10 bulletin.
  • [UPGRADED] CVE-2026-72737 (dokploy/dokploy) — F1: exploitable → functional, AAS: 9.7 → 11.7 (HIGH → HIGH). Originally in 2026-08-10 bulletin.

🟠 [HIGH] sixstorage/6storage_rentals

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:sixstorage:6storage_rentals:*:*:*:*:*:*:*:*

sixstorage 6storage_rentals — 1 vulnerability (CVSS 9.8 HIGH)

The 6Storage Rentals plugin for WordPress versions up to and including 2.27.0 contains a critical authentication bypass vulnerability. An unauthenticated attacker can exploit the six_storage_create_wp_user AJAX handler to hijack any existing WordPress user account by supplying a target email address, as the handler lacks nonce verification, capability checks, and credential validation before setting authentication cookies. This vulnerability is considered exploitable and carries a CVSS score of 9.8.

Any WordPress site running the 6Storage Rentals plugin should treat this as an urgent priority. Site administrators should immediately update to a patched version if available, or deactivate the plugin until a fix is released. Review the vendor advisory for additional technical details and confirm no unauthorized account access has occurred.

Vendor Advisory

🟠 [HIGH] cozmoslabs/user_profile_builder_–_beautiful_user_registration_forms,user_profiles&_user_role_editor

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:cozmoslabs:user_profile_builder_beautiful_user_registration_forms_user_profiles_user_role_editor:*:*:*:*:*:*:*:* (< 3.16.5)

cozmoslabs User Profile Builder — 1 vulnerability (CVSS 9.8 HIGH)

The User Profile Builder plugin for WordPress versions up to and including 3.16.4 contains a critical authentication bypass caused by a type confusion flaw. During user registration, the wppb_log_in_user function applies absint to the result of wp_insert_user before checking for errors, which means a deliberately crafted username of 61 to 70 characters causes a WP_Error object to be coerced to the integer 1, potentially allowing an unauthenticated attacker to authenticate as the site administrator. This vulnerability is considered exploitable and carries a CVSS score of 9.8.

Any WordPress site running User Profile Builder should treat this as an urgent issue. Administrators should update to a patched version immediately if available, or disable the plugin until a fix is released. Review user and access logs for any signs of unauthorized login activity, particularly involving the primary administrator account.

Vendor Advisory

🟠 [HIGH] sc0ttkclark/pods_–_custom_content_types_and_fields

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:sc0ttkclark:pods_custom_content_types_and_fields:*:*:*:*:*:*:*:* (< 3.3.10)

sc0ttkclark Pods – Custom Content Types and Fields — 1 vulnerability (CVSS 9.8 HIGH)

The Pods plugin for WordPress versions up to and including 3.3.9 contains a critical privilege escalation vulnerability caused by an authorization bypass in the pods_admin AJAX router. All access controls, including method allowlisting, nonce verification, login enforcement, and capability checks, are funneled through a pods_error function that, under the JSON meta-box-loader compatibility path, silently logs failures and returns false rather than halting execution. This allows an unauthenticated attacker to bypass every security gate and invoke privileged administrative actions.

WordPress sites running the Pods plugin should treat this as an immediate priority. Administrators should update to a patched version as soon as one is available, or deactivate the plugin until a fix is released. Review server logs for unexpected AJAX requests to the pods_admin endpoint and audit for any unauthorized changes to content types, fields, or user roles.

Vendor Advisory

🟠 [HIGH] wpdevteam/templately_–elementor&_gutenberg_template_library:_6500+free&_pro_ready_templates_and_cloud!

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:wpdevteam:templately_elementor_gutenberg_template_library_6500_free_pro_ready_templates_and_cloud:*:*:*:*:*:*:*:* (< 3.7.2)

wpdevteam Templately — 1 vulnerability (CVSS 8.8 HIGH)

The Templately plugin for WordPress versions up to and including 3.7.1 contains a remote code execution vulnerability in the fetch_remote_file function. File type validation is performed against the attacker-controlled Content-Disposition header filename rather than the actual URL-path-derived destination filename, allowing an attacker to bypass extension checks and upload a malicious file such as a PHP webshell to the server. This vulnerability is considered exploitable and carries a CVSS score of 8.8.

WordPress sites using the Templately plugin should prioritize remediation immediately. Administrators should update to a patched version as soon as one is available, or deactivate the plugin until a fix is released. Review the uploads directory and web server logs for any unexpected file uploads or signs of unauthorized code execution.

Vendor Advisory

🟠 [HIGH] jackdewey/link_library

1 CVE | CVSS 3.1: 9.1 | AAS 9.4

  • cpe:2.3:a:jackdewey:link_library:*:*:*:*:*:*:*:* (< 7.9.5)

jackdewey Link Library — 1 vulnerability (CVSS 9.1 HIGH)

The Link Library plugin for WordPress versions up to and including 7.9.4 contains an arbitrary file deletion vulnerability due to insufficient file path validation in the ll_delete_link_fields function. When the administrator has enabled the “Delete local file on link deletion” setting, an unauthenticated attacker can exploit this flaw to delete critical files on the server, such as wp-config.php, which can lead to full remote code execution. This vulnerability is considered exploitable and carries a CVSS score of 9.1.

WordPress sites running Link Library should address this immediately. Administrators should update to a patched version as soon as one is available, or disable the “Delete local file on link deletion” option and deactivate the plugin as an interim mitigation. Review file system integrity for any evidence of unauthorized deletions, particularly of core WordPress configuration files.

Vendor Advisory