4 vulnerabilities across 4 products scored HIGH or above on October 16, 2026.

  • 🟠 HIGH: 4

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-103849 (adobe/adobe_commerce) — F1: theoretical → functional, AAS: 13.1 → 16.1 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-105899 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.3 → 15.8 (CRITICAL → CRITICAL). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-107806 (0xjacky/nginx-ui) — F1: exploitable → itw, AAS: 10.7 → 13.7 (HIGH → CRITICAL). Originally in 2026-10-09 bulletin.
  • [UPGRADED] CVE-2026-108263 (iflytek/astron-agent) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-10-09 bulletin.

🟠 [HIGH] joedolson/my_calendar_–_accessible_event_manager

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:joedolson:my_calendar_accessible_event_manager:*:*:*:*:*:*:*:* (< 3.8.8)

My Calendar – Accessible Event Manager plugin for WordPress versions up to and including 3.8.7 is affected by one critical-severity vulnerability (CVE-2026-104798, CVSS 9.8). An unauthenticated attacker can exploit unsanitized handling of the public “mcs” GET parameter to inject arbitrary shortcodes, which are then dispatched through call_user_func() without authorization checks, resulting in privilege escalation.

WordPress administrators running any version of the My Calendar plugin up to 3.8.7 should treat this as an urgent priority. Because the attack requires no authentication and targets a publicly accessible parameter, internet-facing WordPress sites with this plugin are immediately at risk. Site operators should update to a patched version as soon as one is available from the vendor, or deactivate the plugin until a fix is confirmed.

Vendor Advisory

🟠 [HIGH] mailoptin/mailoptin

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:mailoptin:mailoptin:*:*:*:*:*:*:*:* (< 1.2.78.7)

MailOptin – Popup, Optin Forms & Email Newsletters plugin for WordPress versions up to and including 1.2.78.6 is affected by one critical-severity vulnerability (CVE-2026-109515, CVSS 9.8). The subscribe_to_email_list endpoint fails to validate destination keys in attacker-supplied form field mappings, allowing an unauthenticated user to override saved administrator mappings and inject arbitrary WordPress user meta values, leading to privilege escalation.

WordPress site operators using any version of the MailOptin plugin up to 1.2.78.6 should act immediately, as this flaw requires no authentication to exploit. Update to a patched release as soon as one becomes available from the vendor, or deactivate the plugin until a fix is confirmed. Given the critical severity and public exposure of WordPress subscription endpoints, this should be treated as a high-priority remediation item.

Vendor Advisory

🟠 [HIGH] wheels/wheels

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:wheels:wheels:*:*:*:*:*:*:*:*

Wheels (CFML web framework) through version 4.1.2 is affected by one critical-severity vulnerability (CVE-2026-111444, CVSS 9.8). When running against MySQL or MariaDB with default backslash escaping enabled, attacker-supplied request data passed through inline-literal code paths — including opt-in parameterize=false queries, IN lists, BETWEEN bounds, function arguments, and LIKE ESCAPE literals — can exploit insufficient quote-escaping logic to achieve SQL injection.

Teams running Wheels-based applications on MySQL or MariaDB should treat this as an urgent remediation item, as the flaw can be reached through normal request data in common query patterns. Update to a patched version as soon as one is available from the Wheels project, or as an interim measure enable the NO_BACKSLASH_ESCAPES SQL mode on the database server and audit application code for use of inline-literal query paths. Refer to the vendor advisory at GitHub for full details and patch guidance.

Vendor Advisory

🟠 [HIGH] jfarthing84/theme_my_login

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:jfarthing84:theme_my_login:*:*:*:*:*:*:*:* (< 7.2.2)

Theme My Login plugin for WordPress versions up to and including 7.2.1 is affected by one critical-severity vulnerability (CVE-2026-89079, CVSS 9.8). The plugin fails to properly validate user identity before processing password changes, allowing unauthenticated attackers to reset arbitrary user passwords on multi-site installations in certain configurations, leading to full account takeover and privilege escalation.

WordPress administrators running Theme My Login on multi-site deployments should treat this as an immediate priority given the unauthenticated attack vector and potential for complete site compromise. Update to the patched release available through the WordPress plugin repository as soon as possible, and audit administrator accounts for any unauthorized password changes. Refer to the vendor changeset for patch details.

Vendor Advisory