Full network takeover via authentication bypass in the InfiniteWP Client WordPress plugin before 1.13.6 affects WordPress Multisite installations, where the plugin fails to validate the site-connection state and the authenticity of requests to its remote-management endpoint. Unauthenticated remote attackers can bind their own management key, hijack an administrator session, and gain control of every site in the network, culminating in remote code execution. No public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) despite the maximal 9.8 CVSS, and a vendor patch is available.
Command injection in the MSI Radix AXE6600 WiFi 6E gaming router (firmware v781521) lets attackers reach the TelnetSSH function that handles Telnet configuration and inject shell metacharacters, yielding arbitrary command execution as root. Reported to NVD via VulnCheck and tagged as Command Injection, the flaw grants full device takeover, but no public exploit or CISA KEV listing has been identified and no patched firmware version has been published. CVSS 4.0 is scored 9.3 and reflects network reach with total loss of confidentiality, integrity, and availability on the router.
OS command injection in the MSI Radix AXE6600 Wi-Fi 6E gaming router (firmware v781521) lets remote attackers inject shell commands through router configuration functions and gain root on the device. The flaw was reported by VulnCheck, a vendor patch is available via MSI support, and no public exploit has been identified at time of analysis. The vendor CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability.
SQL injection in the WP Directory Kit WordPress plugin before 1.5.5 lets unauthenticated attackers inject arbitrary SQL through an unsanitised, unescaped request parameter, exposing the entire WordPress database. Reported by WPScan and rated CVSS 9.1 (high confidentiality and integrity impact), it affects any site running the vulnerable versions. There is no public exploit identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), suggesting no observed mass exploitation yet.