Hackers Exploit Auth Bypass in Burst Statistics WordPress Plugin

Posted on May 14, 2026 by Kyle

Overview

Hackers are actively exploiting a critical authentication bypass vulnerability in the Burst Statistics WordPress plugin. This flaw allows unauthenticated attackers to gain administrative access to affected WordPress sites, posing a significant risk to website integrity and data. Defenders should prioritize patching or disabling this plugin immediately.

Technical Analysis

The vulnerability is an authentication bypass flaw present in the Burst Statistics WordPress plugin. Exploitation of this flaw grants unauthenticated attackers administrative-level privileges on the target WordPress site. The specific mechanism involves bypassing standard authentication checks to access sensitive administrative functions. The article does not specify affected version ranges, but indicates the vulnerability is actively being leveraged in the wild.

Detection

Monitor WordPress access logs for unusual administrative activity originating from unknown or suspicious IP addresses.
Look for the creation of unexpected new administrator user accounts.
Review plugin activity logs for unauthorized modifications or access attempts related to Burst Statistics.
Check for unauthorized file modifications within the WordPress installation directory, particularly within wp-content/plugins/burst-statistics/.

Mitigations

Immediately update the Burst Statistics WordPress plugin to the latest patched version. If an update is not available, disable or uninstall the plugin until a fix is released.
Review all administrative user accounts for any unauthorized additions or modifications. Remove any suspicious accounts.
Implement strong access controls and multi-factor authentication (MFA) for all WordPress administrative interfaces.
Regularly back up WordPress sites to facilitate recovery in case of compromise.

References

https://www.bleepingcomputer.com/news/security/hackers-exploit-auth-bypass-flaw-in-burst-statistics-wordpress-plugin/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  885 input / 554 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-6973: Ivanti EPMM Remote Code Execution Vulnerability

Posted on May 14, 2026 by Kyle

Overview

CVE-2026-6973 is an improper input validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that enables a remotely authenticated user with administrative privileges to execute arbitrary code. This vulnerability poses a significant risk due to the potential for full system compromise on affected EPMM instances.

Technical Analysis

This vulnerability, tracked as CWE-20 (Improper Input Validation), resides within the Ivanti EPMM product. Exploitation requires a user to be already authenticated with administrative access to the EPMM interface.

Vulnerability Type: Improper Input Validation (CWE-20)
Affected Product: Ivanti Endpoint Manager Mobile (EPMM)
Affected Versions:
- ivanti endpoint_manager_mobile before 12.6.1.1
- ivanti endpoint_manager_mobile 12.7.0.0
- ivanti endpoint_manager_mobile 12.8.0.0
Attack Vector: Network (AV:N)
Prerequisites: Remotely authenticated user with administrative access (PR:H)
Impact: Remote Code Execution (RCE), leading to high confidentiality, integrity, and availability impact (C:H/I:H/A:H)
CVSS v3.1 Score: 7.2 (High)
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Detection

Detection efforts should focus on monitoring for unusual activity originating from authenticated administrative sessions on Ivanti EPMM appliances.

Log Analysis: Review EPMM system logs for unexpected commands, process creations, or modifications initiated by administrative accounts.
Behavioral Monitoring: Look for anomalous network connections or outbound traffic from the EPMM appliance that deviates from normal operational patterns.
Process Monitoring: Monitor for the execution of unusual or unauthorized processes on the EPMM server, especially those spawned by the EPMM application’s user context.
Input Validation Failures: While direct indicators of input validation bypass may be difficult to log, look for error messages or system crashes that could indicate malformed input attempts.

Mitigations

Prioritize patching and hardening of Ivanti EPMM instances to prevent exploitation.

Patch Immediately: Upgrade Ivanti EPMM to versions 12.6.1.1, 12.7.0.1, 12.8.0.1 or later. Refer to the Ivanti security advisory for specific patch instructions.
Restrict Administrative Access: Implement strict network access controls (e.g., firewall rules, VPN requirements) to limit access to the EPMM administrative interface only from trusted IP addresses and networks.
Strong Authentication: Enforce multi-factor authentication (MFA) for all administrative accounts accessing EPMM.
Principle of Least Privilege: Ensure administrative accounts have only the minimum necessary permissions required for their roles.

References

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US
https://nvd.nist.gov/vuln/detail/CVE-2026-6973
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-6973

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1059

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,230 input / 1,035 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass

Posted on May 14, 2026 by Kyle

Overview

CVE-2026-20182 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). An unauthenticated, remote attacker can exploit this flaw to bypass authentication, obtain administrative privileges, and manipulate network configurations within the SD-WAN fabric. This vulnerability is rated 10.0 CVSSv3.1 and is listed in CISA’s Known Exploited Vulnerabilities Catalog.

Technical Analysis

This vulnerability stems from improper functioning of the peering authentication mechanism in affected Cisco Catalyst SD-WAN systems. An attacker can exploit this by sending crafted requests to the vulnerable system.

Vulnerability Type: Authentication Bypass (CWE-287)
Affected Products: Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage).
Attack Vector: Network (AV:N).
Prerequisites: No authentication or user interaction required (PR:N, UI:N).
Exploitation: An unauthenticated, remote attacker sends crafted requests to the affected system.
Impact: Successful exploitation grants the attacker administrative privileges, allowing them to log in as an internal, high-privileged, non-root user account. From this account, the attacker can access NETCONF to manipulate network configuration for the SD-WAN fabric.
CVSS 3.1 Score: 10.0 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Detection

Detection efforts should focus on identifying unusual access or configuration changes on SD-WAN control plane devices.

Monitor authentication logs on Cisco Catalyst SD-WAN Controller and Manager for successful logins from unexpected source IPs or user accounts that do not correspond to legitimate administrators.
Look for unauthorized or unexpected configuration changes within the SD-WAN fabric, particularly those related to NETCONF access or network policies.
Regularly review the output of Show Control Connections on SD-WAN devices for any anomalies or unauthorized peering connections, as mentioned in Cisco’s advisory.
Implement network segmentation and monitoring to detect traffic patterns indicative of crafted requests targeting SD-WAN control plane interfaces from unauthorized sources.

Mitigations

Prioritize applying vendor-provided patches and implementing network access controls.

Apply Security Patches: Immediately apply the security updates provided by Cisco to address CVE-2026-20182. Refer to the Cisco Security Advisories for specific version requirements and upgrade paths.
Restrict Network Access: Limit network access to Cisco Catalyst SD-WAN Controller and Manager interfaces to only trusted administrative networks and devices. Implement strict firewall rules to prevent unauthorized external access to these systems.
Monitor Control Plane Activity: Continuously monitor the control plane of your SD-WAN infrastructure for any unusual activity, unauthorized access attempts, or configuration modifications.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-20182
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,364 input / 1,080 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write RCE

Posted on May 14, 2026 by Kyle

Overview

CVE-2026-0300 identifies a critical out-of-bounds write vulnerability within the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS. This flaw enables an unauthenticated attacker to execute arbitrary code with root privileges on affected PA-Series and VM-Series firewalls. Given the unauthenticated nature and root-level impact, this vulnerability poses a severe risk to network perimeter security.

Technical Analysis

Vulnerability Type: Out-of-bounds write.
Affected Service: User-ID Authentication Portal (also known as Captive Portal).
Attack Vector: An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to the affected service.
Impact: Successful exploitation leads to arbitrary code execution with root privileges on the firewall.
Affected Products: Palo Alto Networks PA-Series and VM-Series firewalls.
Affected Versions: Specific affected PAN-OS versions are not detailed in the provided source material. Defenders should consult official Palo Alto Networks advisories for version specifics.

Detection

Log Sources: Monitor firewall system logs, User-ID logs, and network traffic logs for anomalies related to the Captive Portal service.
Behavioral Indicators:
- Unexpected reboots or crashes of the firewall.
- Unusual or high CPU/memory utilization on the firewall, particularly associated with the Captive Portal process.
- Detection of new, unauthorized processes running with root privileges.
- Unusual network traffic patterns directed at the firewall’s Captive Portal interface from untrusted sources.
- Alerts from intrusion detection/prevention systems (IDS/IPS) for malformed packets or exploit attempts targeting the Captive Portal.
Hunt Ideas: Search for connections to the Captive Portal service from external or untrusted networks that exhibit unusual packet sizes, fragmentation, or non-standard protocol behavior.

Mitigations

Patching: Apply security updates from Palo Alto Networks immediately upon availability. This is the primary and most effective mitigation.
Disable Service: If the User-ID Authentication Portal (Captive Portal) is not actively used or required, disable the service to remove the attack surface.
Restrict Access: Implement network access controls (ACLs) to limit which source IP addresses can reach the Captive Portal service on the firewall. Restrict access to only trusted internal networks or specific management IPs.
Network Segmentation: Ensure firewalls are properly segmented from untrusted networks, and that the Captive Portal interface is not directly exposed to the internet unless absolutely necessary.
Monitor Logs: Continuously monitor firewall logs for signs of exploitation attempts or unusual activity related to the Captive Portal service.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-0300

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability

Posted on May 14, 2026 by Kyle

Background

CVE-2026-42208 identifies a critical SQL injection vulnerability within BerriAI LiteLLM. LiteLLM is a proxy for large language models, designed to manage API calls and potentially sensitive configurations or credentials.

Technical Analysis

The SQL injection vulnerability in BerriAI LiteLLM allows an unauthenticated or unauthorized attacker to inject malicious SQL queries into the application’s database interactions. This can result in two primary impacts:

1. Data Exfiltration: Attackers can read arbitrary data from the proxy’s underlying database. This data may include sensitive configurations, user information, or API keys/credentials managed by the LiteLLM proxy.
2. Data Manipulation: The vulnerability also permits the modification of database entries. This could lead to unauthorized changes in proxy configurations, user permissions, or other critical data, potentially disrupting operations or facilitating further compromise.

Exploitation of this vulnerability grants unauthorized access to the proxy itself and the credentials it is configured to manage, posing a significant risk to downstream systems and data.

Detection

Detection of exploitation attempts for CVE-2026-42208 may involve:

* Web Application Firewall (WAF) Logs: Monitoring WAF logs for SQL injection patterns in requests targeting the LiteLLM proxy.
* Application Logs: Reviewing LiteLLM application logs for unusual database query errors or unexpected data access patterns.
* Database Logs: Analyzing database audit logs for anomalous queries, especially those involving sensitive tables or data modification from the LiteLLM service account.
* Network Traffic Analysis: Observing unusual outbound connections or large data transfers from the LiteLLM host, indicative of data exfiltration.

Mitigations

* Patching: Apply the vendor-provided patch immediately upon availability. As this is a newly disclosed vulnerability, monitor BerriAI’s official channels for updates.
* Input Validation: Implement strict input validation and sanitization for all user-supplied data interacting with the LiteLLM proxy to prevent SQL injection payloads.
* Parameterized Queries: Ensure all database interactions within LiteLLM utilize parameterized queries or prepared statements, which inherently prevent SQL injection.
* Least Privilege: Configure the database user account used by LiteLLM with the absolute minimum necessary privileges. It should only have access to the data required for its operation.
* Network Segmentation: Isolate the LiteLLM proxy on a network segment with restricted access to other critical internal systems and databases.
* Monitoring: Enhance monitoring for the LiteLLM proxy and its associated database for suspicious activity, as outlined in the Detection section.

References

* NVD – CVE-2026-42208

CVE-2020-10189: Zoho ManageEngine Desktop Central File Upload Vulnerability

Posted on May 12, 2026 - May 13, 2026 by Kyle

Background

Zoho ManageEngine Desktop Central is a desktop management solution used by organizations to manage their desktop environments. The vulnerability was discovered due to a file upload mechanism that lacks proper validation and sanitization.

Technical Analysis

The vulnerability (CVE-2020-10189) allows an attacker to upload malicious files, which are then executed on the target system without authentication. This can lead to arbitrary code execution, allowing attackers to gain control over the affected systems.

Detection

Detection of this vulnerability may be challenging due to its lack of visibility in traditional security controls. However, monitoring for suspicious file uploads and implementing proper validation and sanitization mechanisms can help detect and prevent exploitation of this vulnerability.

Mitigations

* Implement proper validation and sanitization mechanisms for user-uploaded files.
* Monitor for suspicious file uploads and block unauthorized access.
* Apply the patch released by Zoho to fix the vulnerability.

References

* https://nvd.nist.gov/vuln/detail/CVE-2020-10189