PatchTheCVEBlog · 2-hour update · 2026-10-27
CVE-2026-75891 Kirki plugin: top risk today, fix steps
By the PatchTheCVE security team · Updated 2026-10-27 · Data from NVD, CISA KEV, EPSS and vendor advisories
High severity (CVSS 8.8). Recommended action: apply the vendor mitigation.
On 27 October 2026, 22 new CVEs were published that we track: 0 critical, 0 already exploited in the wild (CISA KEV) and 3 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-75891 (Kirki plugin): apply the vendor mitigation.
- 3 of the top 8 can be attacked over the network without a login.
- 3 of 22 new CVEs already have a fix or vendor patch.
- Most affected vendors: moxa, smci, artbees.
What happened in this 2-hour window: the most serious item is CVE-2026-75891 (high, CVSS 8.8, priority 31/100). Recommended action: apply the vendor mitigation. 3 of the 8 top items can be attacked remotely without a login. Most affected: moxa (3), smci (2), artbees (1). 3 of 22 new CVEs already have a fix or vendor patch; for the other 19, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-75891: The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions
- Risk: High (CVSS 8.8), priority 31/100 (routine), published 27 October 2026
- What to do: apply the vendor mitigation
Why it ranks here: high severity.
References: NVD
CVE-2026-106174: A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthent
- Risk: High (CVSS 7.5), priority 31/100 (routine), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-111820: The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored
- Risk: High (CVSS 7.2), priority 30/100 (routine), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-117470: Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion
- Risk: Medium (CVSS 6.5), priority 28/100 (routine), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: remotely exploitable, no login, no user action.
References: NVD
CVE-2026-111460: A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series
- Risk: High (CVSS 7.7), priority 27/100 (routine), published 27 October 2026
- Affected: moxa oncell g3150a-lte series (1.0.0)
- No fix yet, safe release: before 1.0.0
- What to do: downgrade to a release before 1.0.0 until a fix ships for moxa oncell g3150a-lte series
Why it ranks here: high severity.
References: NVD · Vendor Advisory
CVE-2026-111459: An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client)
- Risk: High (CVSS 7.6), priority 27/100 (routine), published 27 October 2026
- Affected: moxa moxa remote connect suite mrc client (>= 1.0.0 and <= 4.2.0)
- Fixed in: newer than 4.2.0
- What to do: upgrade to newer than 4.2.0 for moxa moxa remote connect suite mrc client
Why it ranks here: high severity.
References: NVD · Vendor Advisory
CVE-2026-18449: The BMC does not correctly enforce integrity and encryption requirements for IPMI commands
- Risk: High (CVSS 7.5), priority 26/100 (routine), published 27 October 2026
- Affected: smci x12spi (01.07.20)
- No fix yet, safe release: before 01.07.20
- What to do: downgrade to a release before 01.07.20 until a fix ships for smci x12spi
Why it ranks here: high severity.
References: NVD
CVE-2026-111461: An OS command injection vulnerability exists in OnCell G3150A-LTE Series
- Risk: High (CVSS 7.5), priority 26/100 (routine), published 27 October 2026
- Affected: moxa oncell g3150a-lte series (1.0.0)
- No fix yet, safe release: before 1.0.0
- What to do: downgrade to a release before 1.0.0 until a fix ships for moxa oncell g3150a-lte series
Why it ranks here: high severity.
References: NVD · Vendor Advisory
Most affected vendors
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 27 October 2026?
CVE-2026-75891 (The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions ) ranks highest, with a priority score of 31/100. Recommended action: apply the vendor mitigation.
Are any of the new CVEs exploited in the wild?
None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.