2 vulnerabilities across 2 products scored HIGH or above on October 17, 2026.

  • 🟠 HIGH: 2

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-103849 (adobe/adobe_commerce) — F1: theoretical → functional, AAS: 13.1 → 16.1 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-105899 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.3 → 15.8 (CRITICAL → CRITICAL). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-87744 (red_hat/quarkus) — F1: exploitable → functional, AAS: 9.4 → 10.4 (HIGH → HIGH). Originally in 2026-10-12 bulletin.

🟠 [HIGH] thimpress/learnpress_–_wordpress_lms_plugin_for_create_and_sell_online_courses

1 CVE | CVSS 3.1: 9.8 | AAS 11.6

  • cpe:2.3:a:thimpress:learnpress_wordpress_lms_plugin_for_create_and_sell_online_courses:*:*:*:*:*:*:*:* (< 4.4.11)

ThimPress LearnPress WordPress LMS Plugin — Critical PHP Object Injection

One critical-severity vulnerability (CVE-2026-104736, CVSS 9.8) affects the LearnPress WordPress LMS plugin in versions up to and including 4.4.10. An unauthenticated attacker can exploit a PHP object injection flaw by sending a crafted serialized payload through the checkout-email parameter during the checkout AJAX action. The input passes through sanitize_text_field(), which does not strip serialized object syntax, and is ultimately passed to unserialize() without class restrictions, potentially allowing remote code execution, data exfiltration, or full site compromise depending on available gadget chains. A proof-of-concept exploit is publicly available, increasing the likelihood of active exploitation.

Any organization running LearnPress for online course management should treat this as an urgent priority. Site administrators should update to a patched version immediately once available from ThimPress, or deactivate the plugin until a fix is released. In the interim, consider deploying a web application firewall rule to block serialized PHP objects in checkout request parameters. Review server logs for suspicious checkout AJAX requests containing serialized data patterns. Refer to the vendor advisory at the WordPress plugin repository for additional technical details and remediation guidance.

Vendor Advisory

🟠 [HIGH] latepoint/appointment_booking_plugin_–latepoint|calendar&_scheduling_for_wordpress

1 CVE | CVSS 3.1: 9.1 | AAS 9.4

  • cpe:2.3:a:latepoint:appointment_booking_plugin_latepoint_calendar_scheduling_for_wordpress:*:*:*:*:*:*:*:*

LatePoint Appointment Booking Plugin for WordPress — Critical Authentication Bypass via Race Condition

One critical-severity vulnerability (CVE-2026-110653, CVSS 9.1) affects the LatePoint Appointment Booking and Scheduling plugin for WordPress in all versions up to and including 5.7.4. The flaw exists in the OTP verification function, where a time-of-check-to-time-of-use race condition allows an attacker to bypass the brute-force attempt limit on one-time passwords. Because the counter increment uses a stale in-memory value without database-level row locking or atomic conditional updates, an attacker can send a flood of concurrent OTP guesses that all pass the attempts check before any increment is committed, effectively defeating the rate limit and enabling full authentication bypass. This vulnerability is considered actively exploitable.

WordPress site administrators using LatePoint for appointment scheduling should update to a patched version as soon as one is available from the vendor. Until a fix is applied, consider temporarily disabling OTP-based authentication or placing the booking system behind additional access controls. Review authentication logs for unusual bursts of concurrent OTP verification attempts, which may indicate exploitation. Refer to the vendor advisory at the WordPress plugin repository for further technical details.

Vendor Advisory