CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, both in popular Joomla extensions and both allowing attackers to upload dangerous files. The iCagenda event calendar flaw (CVE-2026-48939, rated 10.0) lets an attacker upload arbitrary files through its attachment feature, ending in PHP code execution, while the Balbooa Forms flaw (CVE-2026-56291) allows unauthenticated upload of executable files leading to full remote code execution. Federal agencies were ordered to fix them by July 13. The additions line up with a broader campaign, recently flagged by Australia's cyber agency, in which attackers scan the internet and exploit known content-management-system and plugin flaws to plant web shells on vulnerable sites.
Wordfence has seen more than 170 live exploit attempts against CVE-2026-3844, a critical unauthenticated arbitrary file upload in the Breeze Cache WordPress plugin from Cloudways. Breeze has roughly 400,000 active installations, making this one of the larger exposure events of the month. The flaw lives in the fetch_gravatar_from_remote function, which fetches avatar images from an arbitrary remote URL and saves them locally without validating the downloaded file's MIME type - so an attacker can point it at a .php payload and drop a webshell directly into a web-accessible directory. The attack is only possible when the 'Host Files Locally - Gravatars' add-on is enabled, which is not the default, but any site that turned it on for performance reasons is wide open. Cloudways shipped the fix as Breeze 2.4.5 earlier this week; as of publication only about 138,000 of the 400,000 installations had downloaded the patched version, leaving hundreds of thousands of sites exposed to a pre-auth RCE with 9.8 CVSS.
A critical vulnerability in the Ninja Forms File Uploads premium add-on for WordPress allows attackers to upload arbitrary files - including PHP web shells - without any authentication. Over 800,000 WordPress sites use Ninja Forms, and the File Uploads extension is one of its most popular premium add-ons. Successful exploitation gives an attacker full code execution on the web server. No user interaction required - just a crafted request to the file upload endpoint.
TrustStrike Labs