2 vulnerabilities across 2 products scored HIGH or above on November 14, 2026.

  • 🟠 HIGH: 2

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-115934 (craftcms/cms) — F1: exploitable → itw, AAS: 10.5 → 12.5 (HIGH → CRITICAL). Originally in 2026-11-09 bulletin.

🟠 [HIGH] automatorwp/automatorwp_webhooks

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:automatorwp:automatorwp_webhooks:*:*:*:*:*:*:*:* (< 1.4.5)

AutomatorWP Webhooks — Critical Authorization Bypass Enabling Full Account Takeover

One vulnerability has been disclosed in the AutomatorWP Pro plugin’s webhook addon for WordPress, carrying a CVSS score of 9.8. CVE-2026-126173 is an authorization bypass flaw present in all versions through 1.4.4, where the plugin fails to properly verify that a user is authorized to perform sensitive actions. When an administrator has configured an automation using the Receive Webhook trigger, unauthenticated attackers can exploit this to reset the password of any WordPress account, including administrator accounts, achieving full site takeover. A proof-of-concept exploit is available, increasing the likelihood of near-term exploitation in the wild.

WordPress site administrators using the AutomatorWP Pro plugin with the webhooks addon should treat this as an urgent priority. Any site running version 1.4.4 or earlier with webhook-based automations configured is potentially exposed. Administrators should update to a patched version immediately, audit existing webhook automations for unauthorized use, review admin account activity for signs of compromise, and consult the vendor advisory at automatorwp.com for remediation guidance. Until a patch is applied, consider disabling webhook-based automations as a temporary mitigation.

Vendor Advisory

🟠 [HIGH] dokploy/dokploy

1 CVE | CVSS 4.0: 9.4 | AAS 9.0

  • cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* (< 0.31.1)

Dokploy — Critical OS Command Injection Leading to Full Host Compromise

One vulnerability has been disclosed in Dokploy, the open-source self-hosted platform-as-a-service, carrying a CVSS score of 9.4. CVE-2026-129433 is an OS command injection flaw in the getComposeContainerCommand() function present in all versions before 0.31.1. Authenticated organization members can inject shell metacharacters into the serviceName parameter through the backup.create or backup.update tRPC procedures. When scheduled backups execute, the injected commands run as root with access to the mounted Docker socket, giving attackers full control of the underlying host.

Teams running Dokploy for container orchestration and application deployment should treat this as an urgent priority, particularly in multi-tenant environments where organization members may not be fully trusted. Update to version 0.31.1 or later immediately. Until patched, review existing backup configurations for suspicious serviceName values containing shell metacharacters, audit scheduled backup logs for unexpected command execution, and consider restricting backup creation permissions to trusted administrators only. Consult the vendor advisory at vulncheck.com for full technical details and remediation guidance.

Vendor Advisory