Daily Threat Briefing
← All briefings

Templately WordPress Plugin · User Profile Builder WordPress Plugin · Pandora Analysis Platform

Date: 2026-08-16 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s new material centers on a cluster of high-severity WordPress plugin vulnerabilities — most notably a Templately RCE flaw with an EPSS of 0.98 and a User Profile Builder authentication bypass at 0.81 — alongside a new Mirai-based Linux botnet (Evooo1Bot) targeting routers as SOCKS5 relay nodes. A path traversal RCE in Pandora (CVSS 10.0) and multiple critical SiYuan note-taking app vulnerabilities round out the day’s findings. No new CISA KEV additions or BSI/CERT-EU advisories were published in the last 24 hours.

Critical Vulnerabilities

CVE-2026-18438 — Templately WordPress Plugin (RCE)

  • Severity: CVSS 8.8
  • EPSS: 0.98 — very high exploitation probability
  • Technical detail: Remote Code Execution in Templately (Elementor & Gutenberg Template Library) versions ≤ 3.7.1. The vulnerability is exploitable by authenticated users (subscriber-level or above), making it trivially reachable on any site with open registration. Given the plugin’s large install base and the near-certain exploitation probability, treat this as an imminent threat.
  • Exploitation status: No confirmed in-the-wild exploitation reported; EPSS of 0.98 indicates exploitation is highly likely in the near term.
  • Remediation: Update Templately to a version above 3.7.1 immediately. If an update is unavailable, deactivate the plugin. Audit server-side logs for anomalous template rendering requests.

CVE-2026-15826 — User Profile Builder WordPress Plugin (Auth Bypass)

  • Severity: CVSS 9.8
  • EPSS: 0.81 — high exploitation probability
  • Technical detail: Authentication bypass via type confusion in User Profile Builder ≤ 3.16.4. The wppb_log_in_user() function mishandles type comparisons, allowing an unauthenticated attacker to authenticate as any user, including administrators. Widely deployed plugin on e-commerce and membership sites increases attack surface significantly.
  • Exploitation status: No confirmed exploitation; high EPSS warrants urgent treatment.
  • Remediation: Update User Profile Builder to a version above 3.16.4 immediately. Audit WordPress user session logs for unexpected authentication events.

CVE-2026-74764 — Pandora Analysis Platform (Path Traversal / RCE)

  • Severity: CVSS 10.0
  • EPSS: 0.0 (not yet scored meaningfully)
  • Technical detail: Maximum-severity path traversal in Pandora ≤ 1.12.5 during TAR archive extraction. Archive member names are passed directly to Python’s tar extraction routines without sanitization, enabling a crafted archive to write files to arbitrary filesystem locations. In a malware analysis sandbox context, this could allow an attacker to escape the analysis environment or achieve RCE on the host. Assigned by CIRCL (Luxembourg CERT), indicating European relevance.
  • Exploitation status: No confirmed exploitation; CVSS 10.0 warrants immediate action.
  • Remediation: Upgrade Pandora to a version above 1.12.5. Until patched, restrict submission of TAR archives to trusted sources only and isolate the analysis platform from production networks.

CVE-2026-73043 — SiYuan Note-Taking App (RCE via Template Injection)

  • Severity: CVSS 9.4
  • EPSS: 0.0
  • Technical detail: SiYuan versions before 3.7.4 expose a server-side template injection vulnerability in the Template calculation operator, which renders user-authored Go templates without sanitization. An attacker with document-editing access can achieve arbitrary code execution on the server hosting SiYuan. Six additional CVEs in the same release (CVE-2026-73041, CVE-2026-73042, CVE-2026-73044, CVE-2026-73050, CVE-2026-73052, CVE-2026-73053) cover stored XSS across multiple UI surfaces; CVE-2026-73054 adds a WebSocket authentication bypass; CVE-2026-73046/CVE-2026-73045 add brute-force vulnerabilities. All are fixed in v3.7.4.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade SiYuan to v3.7.4 immediately. Organizations running SiYuan as a shared or team knowledge base should treat this as high priority given the RCE and auth bypass combination.

CVE-2026-14484 — RapiSafe WordPress Plugin (Arbitrary File Deletion)

  • Severity: CVSS 9.1
  • EPSS: 0.76 — high exploitation probability
  • Technical detail: Arbitrary file deletion in RapiSafe – Secure Multi File Upload for Contact Form 7 ≤ 1.0.4 via the handleAjaxRemoveUpload function. Insufficient path validation allows an authenticated attacker to delete arbitrary files on the server, including wp-config.php, which can trigger WordPress reinstallation and full site takeover.
  • Exploitation status: No confirmed exploitation; EPSS of 0.76 indicates elevated near-term risk.
  • Remediation: Update or deactivate RapiSafe immediately. Audit file system for unexpected deletions.

ONGOING:

  • CVE-2026-15341 (User Session Synchronizer ≤ 1.4.0): Auth bypass/account takeover — update or deactivate; audit user tables.
  • CVE-2026-15303 (6Storage Rentals ≤ 2.27.0): Auth bypass — update or deactivate; audit user tables.
  • CVE-2026-19682 (Tenable Security Center): Unauthenticated RCE — upgrade to 6.9.0 immediately.
  • CVE-2026-58231 (SAP Commerce Cloud): Active exploitation confirmed — patch and initiate IR review.
  • CVE-2026-48907 (Joomla JCE): Public Metasploit module — update JCE, audit tmp/ for web shells.
  • CVE-2026-17186/17184/17182 (IBM Db2 Mirror for i): Unauthenticated RCE/auth bypass — apply IBM PTFs.
  • CVE-2026-59310 (VMware vCenter): Active exploitation — patch immediately, hunt for SSH persistence.
  • CVE-2026-55040 (SharePoint): Active exploitation — apply July 2026 Patch Tuesday.
  • CVE-2026-68820 (Windows AFD/Lazarus): CISA KEV deadline 2026-08-25 — apply August Patch Tuesday.
  • CVE-2026-63077 (JetBrains TeamCity): Actively exploited — upgrade to 2026.1.3.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation — patch immediately.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched as compromised.
  • CVE-2026-8037 (Progress Kemp LoadMaster): Ransomware exploitation — patch immediately.

European Advisories

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

CVE-2026-74764 (Pandora path traversal, CVSS 10.0) was assigned by CIRCL (Luxembourg’s national CERT), indicating European-origin vulnerability research. Covered in Critical Vulnerabilities above.

Previously reported BSI advisories for PostgreSQL, Golang, Budibase, Elasticsearch, and Linux Kernel remain open — apply vendor patches per standard cycle. No material updates to those advisories in the last 24 hours.

Active Threats and Campaigns

NEW — Evooo1Bot Linux Botnet: A new Mirai-based modular Linux botnet named Evooo1Bot is actively targeting internet-facing gateway devices (routers, CPE equipment) and converting compromised hosts into SOCKS5 traffic relay nodes. The proxy relay capability suggests use for anonymizing follow-on attacks or as a residential proxy network for hire. Organizations should audit internet-facing Linux-based network devices for unexpected outbound SOCKS5 connections and apply firmware updates. (Bleeping Computer)

ONGOING — macOS Screen Sharing active exploitation: No new developments; apply Apple updates and disable Screen Sharing where not required.

ONGOING — Clop / Shell data theft claim: Shell investigating; no new technical details or IOCs published.

ONGOING — Lazarus Group / Operation Dream Job (CVE-2026-68820): No new developments; KEV deadline 2026-08-25.

ONGOING — Akira ransomware EDR Safe Mode bypass: No new developments; enforce Safe Mode boot restrictions via GPO.

Security News and Context

  • BKA online banking fraud (€ millions): German federal police (BKA) and Brazilian authorities arrested suspects following an investigation into a criminal group that exploited a vulnerability in an online banking service provider to defraud customers of millions of euros. (Heise Security)
  1. Templately (CVE-2026-18438, EPSS 0.98): Update above 3.7.1 immediately; audit template rendering logs for anomalous activity.
  2. User Profile Builder (CVE-2026-15826, EPSS 0.81): Update above 3.16.4; review authentication logs for unauthorized sessions.
  3. Pandora (CVE-2026-74764, CVSS 10.0): Upgrade above 1.12.5; restrict TAR archive submissions to trusted sources; isolate from production networks.
  4. SiYuan (CVE-2026-73043 et al.): Upgrade to v3.7.4; prioritize if deployed as a shared team instance.
  5. RapiSafe (CVE-2026-14484, EPSS 0.76): Update or deactivate; audit file system for unexpected deletions including wp-config.php.
  6. Evooo1Bot: Audit internet-facing Linux gateway devices for unexpected SOCKS5 outbound connections; apply firmware updates; review router access logs.
  7. BKA banking fraud advisory: European financial institutions should audit third-party service provider access controls and transaction monitoring for anomalous withdrawal patterns.
  8. SAP Commerce Cloud (CVE-2026-58231): If not yet patched, treat as actively compromised — initiate IR review immediately.
  9. Continue remediation of previously reported items: CVE-2026-19682 (Tenable SC), CVE-2026-48907 (Joomla JCE), CVE-2026-17186 (IBM Db2), CVE-2026-59310 (vCenter), CVE-2026-55040 (SharePoint), CVE-2026-68820 (Windows/Lazarus — KEV deadline 2026-08-25), CVE-2026-63077 (TeamCity), CVE-2026-0257 (PAN-OS), CVE-2026-16232 (Check Point), CVE-2026-8037 (LoadMaster).