NVD disclosure day
CVE-2026-88800
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in MDJM Event Management and Mobile Events Manager WordPress plugins allows unauthenticated attackers to delete any user role, including administrators, by exploiting a flawed role deletion process on every page load. This could lead to a permanent loss of user capabilities and disrupt site fun
CVE-2026-120844
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical privilege escalation vulnerability exists in the miniOrange OAuth Single Sign-On plugin, potentially allowing unauthenticated attackers to gain elevated system access. This issue impacts the authentication process for applications using the plugin as an OAuth client. Confirmation of its use and exposure is a
CVE-2026-119516
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical deserialization vulnerability exists in the Radius Booking plugin, allowing object injection. If reachable, an attacker could execute arbitrary code, potentially compromising the affected system. Confirmation of plugin usage and internet exposure is needed to assess the risk.
CVE-2026-118423
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in the WP Libre Form WordPress plugin allows unauthenticated attackers to upload and execute PHP files, potentially leading to remote code execution and website compromise. This issue should be addressed by identifying plugin usage and implementing remediation.