TL;DR The Mautic project released security updates on October 26, 2026, to resolve multiple critical and high-severity Mautic vulnerabilities across its open-source marketing automation platform. The most severe flaw, CVE-2026-115188, carries a critical 9.9 CVSS score and enables remote code execution through unrestricted file uploads. Therefore, system administrators must upgrade their installations to versions 7.2.2, 6.0.10, or 5.2.12 immediately. Why It Matters…

TL;DR Wordfence researchers discovered an unauthenticated PHP Object Injection vulnerability (CVE-2026-82814) in the Duplicator WordPress plugin and Duplicator Pro. The flaw allows attackers to plant a dormant payload inside a public comment that triggers during a site migration, leading to command execution or site takeover. Administrators must update to version 5.0.0 or newer immediately and recreate older migration packages. Why It Matters…

CVE-2026-12378 es una vulnerabilidad de PHP Object Injection en el plugin Appointment Booking Calendar para WordPress hasta la versión 1.1.28, con riesgo de RCE sin autenticación.

CVE-2026-7635 afecta coreActivity hasta v3.0: inyección de objetos PHP vía User-Agent que bloquea el panel de logs de administración. Parche disponible en v3.1.