Critical vulnerabilities
2 critical vulnerabilities in 2 WordPress plugins
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 6 November 2026: Privilege escalation in WordPress plugins, Arbitrary file access in WordPress plugins.
- 2 critical
Privilege escalation in BuddyForms · WordPress plugins
CVE-2026-107622
BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter
- Severity
- Critical 9.8
- Published
- 6 Nov 2026
| Software | Affected versions |
|---|---|
| Buddyforms (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-107622
Arbitrary file access in ELEX WordPress HelpDesk & Customer Ticketing System · WordPress plugins
CVE-2026-114630
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
- Severity
- Critical 9.1
- Published
- 6 Nov 2026
| Software | Affected versions |
|---|---|
| Elex Helpdesk Customer Support Ticket System (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114630
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.