Skip to content
High Severity CVEs Affecting WordPress Plugins Disclosed

High Severity CVEs Affecting WordPress Plugins Disclosed

First seen 10 Jul 2026, 19:01 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 1, 2026 at 14:16 UTC
  • •CVE-2026-15070 and CVE-2026-15005 both have a CVSS score of 8.8, indicating high severity.
  • •Both vulnerabilities allow unauthenticated attackers to execute arbitrary PHP code via CSRF.
  • •Users of affected WordPress plugins are advised to patch immediately to mitigate risks.

Two high severity vulnerabilities, CVE-2026-15070 and CVE-2026-15005, have been identified in WordPress plugins. CVE-2026-15070 affects the Salon Booking System plugin, allowing unauthenticated attackers to execute arbitrary PHP code via Cross-Site Request Forgery due to improper nonce validation. CVE-2026-15005 impacts the Loco Translate plugin, enabling similar remote code execution through a crafted request. Both vulnerabilities have a CVSS score of 8.8, indicating a high level of risk. Users of the affected plugins are urged to apply patches immediately. The Salon Booking System vulnerability was published on July 10, 2026, while the Loco Translate vulnerability was published on July 16, 2026. Has not been confirmed for either CVE, but the potential for exploitation remains significant.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 9d ago How this analysis works

Timeline

2026-07-10
CVE-2026-15070 published
The Salon Booking System plugin for WordPress was disclosed as vulnerable to CSRF attacks, allowing remote code execution.
Sherlockforensics
2026-07-16
CVE-2026-15005 published
The Loco Translate plugin for WordPress was disclosed as vulnerable to CSRF attacks, enabling arbitrary PHP code execution.
Ismalicious

More articles in this cluster (6)

Following this threat?

Track CVE-2026-15070 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (1)

1 / 2

Common questions

Which versions of the plugins are affected?
The Salon Booking System plugin is affected in all versions up to and including 10.30.32, while the Loco Translate plugin is affected in all versions up to and including 2.8.5.
Is there active exploitation of these vulnerabilities?
Active exploitation has not been confirmed for either CVE, but the vulnerabilities are considered high risk.
What should I do if I use these plugins?
You should apply the patches for the affected plugins immediately to mitigate the risk of exploitation.