Between 26 and 28 July the National Vulnerability Database published four critical flaws in WordPress plugins, each scored CVSS 9.8, each letting an unauthenticated attacker walk off with a site. Four maximum-severity entries in one publishing window is unusual. The pattern behind them isn't.
The four flaws
- CVE-2026-15014: SMS Alert for WooCommerce, all versions up to 3.9.7. An authentication bypass through the billing_phone parameter allows account takeover.
- CVE-2026-14545: TrueBooker before 1.2.4 fails to validate account ownership during password resets, so an attacker can set a new password for any account, administrators included.
- CVE-2026-13714: Realtyna Organic IDX and WPL Real Estate before 5.3.0 accept unvalidated file uploads, behind an API secured with hardcoded credentials shared across installations.
- CVE-2026-12394: MemberGlut before 1.1.5 lets anyone choose their own role at registration, administrator included.
None of these sits in WordPress core. All four live in the plugin layer, in the unglamorous machinery of bookings, listings, memberships and order notifications. And all four fail in the same place: the code trusts input it should be checking, whether that's a phone number, a password reset request, an upload, or a role field.
Why this lands on hosts
Our directory tracks 30,465 active companies, of which 7,151 are pure hosting providers. Among those, 906 describe WordPress hosting in their own service listings, and 120 sell managed WordPress or WooCommerce specifically. A plugin takeover chain isn't an abstract risk for that group, it's the most common route by which a customer site on their infrastructure turns into a phishing kit, a spam relay, or a malware distribution point.
The difference between a bad week and a quiet one comes down to operations:
- Virtual patching at the web application firewall, so a known exploit pattern gets blocked before the plugin author ships a fix.
- Managed plugin updates with staged rollout, rather than leaving update cadence to each site owner.
- Account isolation, so one compromised site can't reach its neighbours.
- Outbound filtering, which turns a compromised site from an active attack platform into a contained incident.
These are the capabilities that separate managed WordPress products from plain space on a server, and this week made that case better than any sales page could.
What site owners should do today
Check whether any of the four plugins is installed. Update SMS Alert past 3.9.7, TrueBooker to 1.2.4, Realtyna to 5.3.0, and MemberGlut to 1.1.5 or newer. Then go through the administrator list for accounts you don't recognise, because three of the four flaws end with an attacker holding one.
The plugin data behind this piece is tracked on our WordPress plugin tracker, and the hosts that specialise in this work are ranked on the managed WordPress hosting list.