CVE-2026-59504

CRITICAL9.1

Published 2026-08-13 · Source cna@cyber.gov.il

CWE-602: Client-Side Enforcement of Server-Side Security

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-602

Same severity, most recent

CVE-2026-59507
CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control
2026-08-13 · score 9.3
CVE-2026-59506
CWE-306: Missing Authentication for Critical Function
2026-08-13 · score 9.3
CVE-2026-59503
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
2026-08-13 · score 9.1
CVE-2026-59500
CWE-287: Improper Authentication
2026-08-13 · score 10.0
CVE-2026-15413
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
2026-08-13 · score 10.0