CVE-2026-59506

CRITICAL9.3

Published 2026-08-13 · Source cna@cyber.gov.il

CWE-306: Missing Authentication for Critical Function

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CWE-306

Same severity, most recent

CVE-2026-59507
CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control
2026-08-13 · score 9.3
CVE-2026-59504
CWE-602: Client-Side Enforcement of Server-Side Security
2026-08-13 · score 9.1
CVE-2026-59503
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
2026-08-13 · score 9.1
CVE-2026-59500
CWE-287: Improper Authentication
2026-08-13 · score 10.0
CVE-2026-15413
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
2026-08-13 · score 10.0